+++ /dev/null
-if (BUILD_EXTRA_PLUGINS)
- # This condition is only true if this directory is included as
- # a subdirectory of the top level source directory.
-
- set(SNORT_EXECUTABLE $<TARGET_FILE:snort> CACHE INTERNAL "Snort binary" FORCE)
- add_subdirectory(src)
-
-else (BUILD_EXTRA_PLUGINS)
-
- cmake_minimum_required(VERSION 2.8.8)
- project(snort_extra CXX C)
-
- set (EXTRA_VERSION_MAJOR 1)
- set (EXTRA_VERSION_MINOR 0)
- set (EXTRA_VERSION_BUILD 0-a4)
- set (VERSION "${EXTRA_VERSION_MAJOR}.${EXTRA_VERSION_MINOR}.${EXTRA_VERSION_BUILD}")
-
- set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -std=c++11")
- set (CMAKE_MODULE_PATH ${CMAKE_MODULE_PATH} "${CMAKE_SOURCE_DIR}")
-
- # Look for Snort using pkg-config and our own find-snort module
-
- if (APPLE)
- set(CMAKE_MACOSX_RPATH OFF)
- endif(APPLE)
-
- find_package(DAQ REQUIRED)
- find_package(Snort REQUIRED)
- find_package(LuaJIT REQUIRED)
-
-
- # add Snort++ properties to the current build
- string (REPLACE "-DHAVE_CONFIG_H" " " tmp_cmp_flags "${SNORT_INTERFACE_COMPILE_OPTIONS}")
- string (REPLACE ";" " " tmp_cmp_flags "${tmp_cmp_flags}")
- string (STRIP "${CMAKE_CXX_FLAGS} ${tmp_cmp_flags}" tmp_cmp_flags)
- set (CMAKE_CXX_FLAGS "${tmp_cmp_flags}" CACHE STRING
- "Flags used by the compiler during all build types." FORCE)
-
- include_directories(${SNORT_INTERFACE_INCLUDE_DIRECTORIES})
-
- string(REPLACE ";" " " tmp_link_flags "${SNORT_INTERFACE_LINK_FLAGS}")
- string (STRIP "${CMAKE_EXE_LINKER_FLAGS} ${tmp_link_flags}" tmp_link_flags)
- set (CMAKE_EXE_LINKER_FLAGS "${tmp_link_flags}" CACHE STRING
- "Flags used by the linker. " FORCE)
-
-
- include(CheckCXXCompilerFlag)
- set (CMAKE_REQUIRED_FLAGS "-fvisibility=hidden")
- check_cxx_compiler_flag (${CMAKE_REQUIRED_FLAGS} HAVE_VISIBILITY)
- if (HAVE_VISIBILITY)
- set (CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} ${CMAKE_REQUIRED_FLAGS} -DHAVE_VISIBILITY")
- endif ()
- unset(CMAKE_REQUIRED_FLAGS)
-
- # Some shared library flags for the two platforms which I am using
- set(CMAKE_REQUIRED_FLAGS "-Wl,-undefined,dynamic_lookup")
- check_cxx_compiler_flag(${CMAKE_REQUIRED_FLAGS} HAVE_DYNAMIC_LOOKUP)
- if(HAVE_DYNAMIC_LOOKUP)
- set(CMAKE_SHARED_LINKER_FLAGS "${CMAKE_SHARED_LINKER_FLAGS} ${CMAKE_REQUIRED_FLAGS}")
- endif()
- unset (CMAKE_REQUIRED_FLAGS)
-
-
- set (CMAKE_REQUIRED_FLAGS "-Wl,-export-dynamic")
- check_cxx_compiler_flag (${CMAKE_REQUIRED_FLAGS} HAVE_EXPORT_DYNAMIC)
- if (HAVE_EXPORT_DYNAMIC)
- set(CMAKE_SHARED_LINKER_FLAGS "${CMAKE_SHARED_LINKER_FLAGS} ${CMAKE_REQUIRED_FLAGS}")
- endif ()
- unset(CMAKE_REQUIRED_FLAGS)
-
-
- set (CMAKE_REQUIRED_FLAGS "-Wl,-shared")
- check_cxx_compiler_flag (${CMAKE_REQUIRED_FLAGS} HAVE_SHARED)
- if (HAVE_SHARED)
- set(CMAKE_SHARED_LINKER_FLAGS "${CMAKE_SHARED_LINKER_FLAGS} ${CMAKE_REQUIRED_FLAGS}")
- endif ()
- unset(CMAKE_REQUIRED_FLAGS)
-
- add_subdirectory(src)
-
-
- # adding make unisntall
- configure_file(
- "${CMAKE_CURRENT_SOURCE_DIR}/cmake_uninstall.cmake.in"
- "${CMAKE_CURRENT_BINARY_DIR}/cmake_uninstall.cmake"
- IMMEDIATE @ONLY)
-
- add_custom_target(uninstall
- COMMAND ${CMAKE_COMMAND} -P ${CMAKE_CURRENT_BINARY_DIR}/cmake_uninstall.cmake)
-
- include (packaging_data.cmake)
-
-endif (BUILD_EXTRA_PLUGINS)
+++ /dev/null
-*****************************************************************************
-The text that follows is the GNU General Public License, Version 2 (GPL V2)
-and governs your use, modification and/or distribution of SNORT.
-
-Section 9 of the GPL V2 acknowledges that the Free Software Foundation may
-publish revised and/or new versions of the GPL V2 from time to time. Section 9
-further states that a licensee of a program subject to the GPL V2 could be
-free to use any such revised and/or new versions under two different scenarios:
-
-1. "Failure to Specify." Section 9 of the GPL V2 allows a licensee of a
-program governed by an unspecified version of the General Public License to
-choose any version of the General Public License ever published by the Free
-Software Foundation to govern his or her use of such program.
-
-This provision is not applicable to your use of SNORT because we have
-expressly stated in a number of instances that any third party's use,
-modification or distribution of SNORT is governed by GPL V2.
-
-2. "Any Later Version." At the end of the terms and condition of the GPL V2 is
-a section called "How to Apply these Terms to Your New Program," which
-provides guidance to a developer on how to apply the GPL V2 to a third party's
-use, modification and/or distribution of his/her program. Among other things,
-this guidance suggests that the developer attach certain notices to the
-program. Of particular importance is the following notice:
-
-"This program is free software; you can redistribute it and/or modify it under
-the terms of the GNU General Public License as published by the Free Software
-Foundation; either version 2 of the License, or (at your option) any later
-version."
-
-Thus if a developer follows strictly the guidance provided by the Free
-Software Foundation, Section 9 of the GPL V2 provides the licensee the option
-to either use, modify or distribute the program under GPL V2 or under any
-later version published by the Free Software Foundation.
-
-SNORT is an open source project that is governed exclusively by the GPL V2
-and any third party desiring to use, modify or distribute SNORT must do so by
-strictly following the terms and conditions of GPL V2. Anyone using, modifying
-or distributing SNORT does not have the option to chose to use, modify or
-distribute SNORT under any revised or new version of the GPL, including
-without limitation, the GNU General Public License Version 3.
-
-For ease of reference, the comparable notice that is used with SNORT
-(contained in the 'README' file) is as follows:
-
-"This program is free software; you can redistribute it and/or modify it under
-the terms of the GNU General Public License Version 2 as published by the Free
-Software Foundation. You may not use, modify or distribute this program under
-any other version of the GNU General Public License."
-
-If you have any questions about this statement, please feel free to email
-snort-info@snort.org.
-*****************************************************************************
-
- GNU GENERAL PUBLIC LICENSE
- Version 2, June 1991
-
- Copyright (C) 1989, 1991 Free Software Foundation, Inc.
- 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA
- Everyone is permitted to copy and distribute verbatim copies
- of this license document, but changing it is not allowed.
-
- Preamble
-
- The licenses for most software are designed to take away your
-freedom to share and change it. By contrast, the GNU General Public
-License is intended to guarantee your freedom to share and change free
-software--to make sure the software is free for all its users. This
-General Public License applies to most of the Free Software
-Foundation's software and to any other program whose authors commit to
-using it. (Some other Free Software Foundation software is covered by
-the GNU Library General Public License instead.) You can apply it to
-your programs, too.
-
- When we speak of free software, we are referring to freedom, not
-price. Our General Public Licenses are designed to make sure that you
-have the freedom to distribute copies of free software (and charge for
-this service if you wish), that you receive source code or can get it
-if you want it, that you can change the software or use pieces of it
-in new free programs; and that you know you can do these things.
-
- To protect your rights, we need to make restrictions that forbid
-anyone to deny you these rights or to ask you to surrender the rights.
-These restrictions translate to certain responsibilities for you if you
-distribute copies of the software, or if you modify it.
-
- For example, if you distribute copies of such a program, whether
-gratis or for a fee, you must give the recipients all the rights that
-you have. You must make sure that they, too, receive or can get the
-source code. And you must show them these terms so they know their
-rights.
-
- We protect your rights with two steps: (1) copyright the software, and
-(2) offer you this license which gives you legal permission to copy,
-distribute and/or modify the software.
-
- Also, for each author's protection and ours, we want to make certain
-that everyone understands that there is no warranty for this free
-software. If the software is modified by someone else and passed on, we
-want its recipients to know that what they have is not the original, so
-that any problems introduced by others will not reflect on the original
-authors' reputations.
-
- Finally, any free program is threatened constantly by software
-patents. We wish to avoid the danger that redistributors of a free
-program will individually obtain patent licenses, in effect making the
-program proprietary. To prevent this, we have made it clear that any
-patent must be licensed for everyone's free use or not licensed at all.
-
- The precise terms and conditions for copying, distribution and
-modification follow.
-\f
- GNU GENERAL PUBLIC LICENSE
- TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
-
- 0. This License applies to any program or other work which contains
-a notice placed by the copyright holder saying it may be distributed
-under the terms of this General Public License. The "Program", below,
-refers to any such program or work, and a "work based on the Program"
-means either the Program or any derivative work under copyright law:
-that is to say, a work containing the Program or a portion of it,
-either verbatim or with modifications and/or translated into another
-language. (Hereinafter, translation is included without limitation in
-the term "modification".) Each licensee is addressed as "you".
-
-Activities other than copying, distribution and modification are not
-covered by this License; they are outside its scope. The act of
-running the Program is not restricted, and the output from the Program
-is covered only if its contents constitute a work based on the
-Program (independent of having been made by running the Program).
-Whether that is true depends on what the Program does.
-
- 1. You may copy and distribute verbatim copies of the Program's
-source code as you receive it, in any medium, provided that you
-conspicuously and appropriately publish on each copy an appropriate
-copyright notice and disclaimer of warranty; keep intact all the
-notices that refer to this License and to the absence of any warranty;
-and give any other recipients of the Program a copy of this License
-along with the Program.
-
-You may charge a fee for the physical act of transferring a copy, and
-you may at your option offer warranty protection in exchange for a fee.
-
- 2. You may modify your copy or copies of the Program or any portion
-of it, thus forming a work based on the Program, and copy and
-distribute such modifications or work under the terms of Section 1
-above, provided that you also meet all of these conditions:
-
- a) You must cause the modified files to carry prominent notices
- stating that you changed the files and the date of any change.
-
- b) You must cause any work that you distribute or publish, that in
- whole or in part contains or is derived from the Program or any
- part thereof, to be licensed as a whole at no charge to all third
- parties under the terms of this License.
-
- c) If the modified program normally reads commands interactively
- when run, you must cause it, when started running for such
- interactive use in the most ordinary way, to print or display an
- announcement including an appropriate copyright notice and a
- notice that there is no warranty (or else, saying that you provide
- a warranty) and that users may redistribute the program under
- these conditions, and telling the user how to view a copy of this
- License. (Exception: if the Program itself is interactive but
- does not normally print such an announcement, your work based on
- the Program is not required to print an announcement.)
-\f
-These requirements apply to the modified work as a whole. If
-identifiable sections of that work are not derived from the Program,
-and can be reasonably considered independent and separate works in
-themselves, then this License, and its terms, do not apply to those
-sections when you distribute them as separate works. But when you
-distribute the same sections as part of a whole which is a work based
-on the Program, the distribution of the whole must be on the terms of
-this License, whose permissions for other licensees extend to the
-entire whole, and thus to each and every part regardless of who wrote it.
-
-Thus, it is not the intent of this section to claim rights or contest
-your rights to work written entirely by you; rather, the intent is to
-exercise the right to control the distribution of derivative or
-collective works based on the Program.
-
-In addition, mere aggregation of another work not based on the Program
-with the Program (or with a work based on the Program) on a volume of
-a storage or distribution medium does not bring the other work under
-the scope of this License.
-
- 3. You may copy and distribute the Program (or a work based on it,
-under Section 2) in object code or executable form under the terms of
-Sections 1 and 2 above provided that you also do one of the following:
-
- a) Accompany it with the complete corresponding machine-readable
- source code, which must be distributed under the terms of Sections
- 1 and 2 above on a medium customarily used for software interchange; or,
-
- b) Accompany it with a written offer, valid for at least three
- years, to give any third party, for a charge no more than your
- cost of physically performing source distribution, a complete
- machine-readable copy of the corresponding source code, to be
- distributed under the terms of Sections 1 and 2 above on a medium
- customarily used for software interchange; or,
-
- c) Accompany it with the information you received as to the offer
- to distribute corresponding source code. (This alternative is
- allowed only for noncommercial distribution and only if you
- received the program in object code or executable form with such
- an offer, in accord with Subsection b above.)
-
-The source code for a work means the preferred form of the work for
-making modifications to it. For an executable work, complete source
-code means all the source code for all modules it contains, plus any
-associated interface definition files, plus the scripts used to
-control compilation and installation of the executable. However, as a
-special exception, the source code distributed need not include
-anything that is normally distributed (in either source or binary
-form) with the major components (compiler, kernel, and so on) of the
-operating system on which the executable runs, unless that component
-itself accompanies the executable.
-
-If distribution of executable or object code is made by offering
-access to copy from a designated place, then offering equivalent
-access to copy the source code from the same place counts as
-distribution of the source code, even though third parties are not
-compelled to copy the source along with the object code.
-\f
- 4. You may not copy, modify, sublicense, or distribute the Program
-except as expressly provided under this License. Any attempt
-otherwise to copy, modify, sublicense or distribute the Program is
-void, and will automatically terminate your rights under this License.
-However, parties who have received copies, or rights, from you under
-this License will not have their licenses terminated so long as such
-parties remain in full compliance.
-
- 5. You are not required to accept this License, since you have not
-signed it. However, nothing else grants you permission to modify or
-distribute the Program or its derivative works. These actions are
-prohibited by law if you do not accept this License. Therefore, by
-modifying or distributing the Program (or any work based on the
-Program), you indicate your acceptance of this License to do so, and
-all its terms and conditions for copying, distributing or modifying
-the Program or works based on it.
-
- 6. Each time you redistribute the Program (or any work based on the
-Program), the recipient automatically receives a license from the
-original licensor to copy, distribute or modify the Program subject to
-these terms and conditions. You may not impose any further
-restrictions on the recipients' exercise of the rights granted herein.
-You are not responsible for enforcing compliance by third parties to
-this License.
-
- 7. If, as a consequence of a court judgment or allegation of patent
-infringement or for any other reason (not limited to patent issues),
-conditions are imposed on you (whether by court order, agreement or
-otherwise) that contradict the conditions of this License, they do not
-excuse you from the conditions of this License. If you cannot
-distribute so as to satisfy simultaneously your obligations under this
-License and any other pertinent obligations, then as a consequence you
-may not distribute the Program at all. For example, if a patent
-license would not permit royalty-free redistribution of the Program by
-all those who receive copies directly or indirectly through you, then
-the only way you could satisfy both it and this License would be to
-refrain entirely from distribution of the Program.
-
-If any portion of this section is held invalid or unenforceable under
-any particular circumstance, the balance of the section is intended to
-apply and the section as a whole is intended to apply in other
-circumstances.
-
-It is not the purpose of this section to induce you to infringe any
-patents or other property right claims or to contest validity of any
-such claims; this section has the sole purpose of protecting the
-integrity of the free software distribution system, which is
-implemented by public license practices. Many people have made
-generous contributions to the wide range of software distributed
-through that system in reliance on consistent application of that
-system; it is up to the author/donor to decide if he or she is willing
-to distribute software through any other system and a licensee cannot
-impose that choice.
-
-This section is intended to make thoroughly clear what is believed to
-be a consequence of the rest of this License.
-\f
- 8. If the distribution and/or use of the Program is restricted in
-certain countries either by patents or by copyrighted interfaces, the
-original copyright holder who places the Program under this License
-may add an explicit geographical distribution limitation excluding
-those countries, so that distribution is permitted only in or among
-countries not thus excluded. In such case, this License incorporates
-the limitation as if written in the body of this License.
-
- 9. The Free Software Foundation may publish revised and/or new versions
-of the General Public License from time to time. Such new versions will
-be similar in spirit to the present version, but may differ in detail to
-address new problems or concerns.
-
-Each version is given a distinguishing version number. If the Program
-specifies a version number of this License which applies to it and "any
-later version", you have the option of following the terms and conditions
-either of that version or of any later version published by the Free
-Software Foundation. If the Program does not specify a version number of
-this License, you may choose any version ever published by the Free Software
-Foundation.
-
- 10. If you wish to incorporate parts of the Program into other free
-programs whose distribution conditions are different, write to the author
-to ask for permission. For software which is copyrighted by the Free
-Software Foundation, write to the Free Software Foundation; we sometimes
-make exceptions for this. Our decision will be guided by the two goals
-of preserving the free status of all derivatives of our free software and
-of promoting the sharing and reuse of software generally.
-
- NO WARRANTY
-
- 11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
-FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN
-OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
-PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
-OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
-MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS
-TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE
-PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
-REPAIR OR CORRECTION.
-
- 12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
-WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
-REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
-INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
-OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
-TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
-YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
-PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
-POSSIBILITY OF SUCH DAMAGES.
-
- END OF TERMS AND CONDITIONS
-\f
- How to Apply These Terms to Your New Programs
-
- If you develop a new program, and you want it to be of the greatest
-possible use to the public, the best way to achieve this is to make it
-free software which everyone can redistribute and change under these terms.
-
- To do so, attach the following notices to the program. It is safest
-to attach them to the start of each source file to most effectively
-convey the exclusion of warranty; and each file should have at least
-the "copyright" line and a pointer to where the full notice is found.
-
- <one line to give the program's name and a brief idea of what it does.>
- Copyright (C) 19yy <name of author>
-
- This program is free software; you can redistribute it and/or modify
- it under the terms of the GNU General Public License as published by
- the Free Software Foundation; either version 2 of the License, or
- (at your option) any later version.
-
- This program is distributed in the hope that it will be useful,
- but WITHOUT ANY WARRANTY; without even the implied warranty of
- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- GNU General Public License for more details.
-
- You should have received a copy of the GNU General Public License
- along with this program; if not, write to the Free Software
- Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
- USA
-
-
-Also add information on how to contact you by electronic and paper mail.
-
-If the program is interactive, make it output a short notice like this
-when it starts in an interactive mode:
-
- Gnomovision version 69, Copyright (C) 19yy name of author
- Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
- This is free software, and you are welcome to redistribute it
- under certain conditions; type `show c' for details.
-
-The hypothetical commands `show w' and `show c' should show the appropriate
-parts of the General Public License. Of course, the commands you use may
-be called something other than `show w' and `show c'; they could even be
-mouse-clicks or menu items--whatever suits your program.
-
-You should also get your employer (if you work as a programmer) or your
-school, if any, to sign a "copyright disclaimer" for the program, if
-necessary. Here is a sample; alter the names:
-
- Yoyodyne, Inc., hereby disclaims all copyright interest in the program
- `Gnomovision' (which makes passes at compilers) written by James Hacker.
-
- <signature of Ty Coon>, 1 April 1989
- Ty Coon, President of Vice
-
-This General Public License does not permit incorporating your program into
-proprietary programs. If your program is a subroutine library, you may
-consider it more useful to permit linking proprietary applications with the
-library. If this is what you want to do, use the GNU Library General
-Public License instead of this License.
+++ /dev/null
-#
-#
-# Locate DAQ library
-# This module defines
-# DAQ_FOUND, if false, do not try to link to Lua
-#
-# DAQ_FOUND - system has the daq
-# DAQ_INCLUDE_DIR - the daqs include directory
-# DAQ_LIBRARIES - the libraries needed to use the daq
-#
-## Copied from default CMake FindLua51.cmake
-
-
-
-set (ERROR_MESSAGE
- "
- ERROR! cannot find the DAQ. Go get it from
- http://snort.org/snort-downloads or use the --with-daq-*
- options if you have it installed inn an unusual place. You can
- also set the DAQ_DIR environment variablet to the daqs root installation directory\n\n"
-)
-
-
-
-find_path(DAQ_INCLUDE_DIR
- NAMES daq.h
- HINTS ENV DAQ_DIR
- PATH_SUFFIXES daq
-)
-
-
-# find any static libraries
-if (ENABLE_STATIC_DAQ)
- execute_process(
- COMMAND daq-modules-config --static --libs
- OUTPUT_VARIABLE DAQ_STATIC_LIBRARIES
- RESULT_VARIABLE result
- OUTPUT_STRIP_TRAILING_WHITESPACE
- )
-
- # This will be false if the exit status was 0 and true if the binary was not found
- if (result)
- message(FATAL_ERROR "
-
- ERROR! cannot find the DAQs static libraries! make sure the binary
- file `daq-modules-config` is in your path, or specific the daqs path
- with the --with-daq-root=<dir>
-
- ")
- endif()
-
- set(DAQ_LIB daq_static)
-else()
- set(DAQ_LIB daq)
- set(DAQ_STATIC_LIBRARIES)
-endif()
-
-
-find_library(DAQ_LIBRARY
- NAMES ${DAQ_LIB}
- HINTS ${DAQ_LIBRARIES_DIR} # user specified path in ./configure_cmake.sh
- DOC "DAQ library directory"
- NO_DEFAULT_PATH
- NO_CMAKE_ENVIRONMENT_PATH
-)
-
-find_library(DAQ_LIBRARY
- NAMES ${DAQ_LIB}
- HINTS ENV DAQ_DIR
- PATH_SUFFIXES daq
- DOC "DAQ library directory"
-)
-
-set(DAQ_LIBRARIES ${DAQ_LIBRARY} ${DAQ_STATIC_LIBRARIES})
-
-include(FindPackageHandleStandardArgs)
-find_package_handle_standard_args(DAQ
- REQUIRED_VARS DAQ_LIBRARY DAQ_LIBRARIES DAQ_INCLUDE_DIR
- FAIL_MESSAGE "${ERROR_MESSAGE}"
-)
-
-mark_as_advanced(
- DAQ_INCLUDE_DIR
- DAQ_LIBRARY
- DAQ_LIBRARIES
-)
+++ /dev/null
-#
-# Locate LUAJIT library
-# This module defines
-# LUAJIT_FOUND, if false, do not try to link to Lua
-# LUAJIT_LIBRARIES
-# LUAJIT_INCLUDE_DIR, where to find lua.h
-# LUAJIT_VERSION_STRING, the version of Lua found (since CMake 2.8.8)
-
-## Copied from default CMake FindLua51.cmake
-set( LUA_PATHS
- ~/Library/Frameworks
- /Library/Frameworks
- /sw
- /opt/local
- /opt/csw
- /opt
-)
-
-set(ERROR_MESSAGE
- "\n\tCan't Find luajit! Get it from
- http://luajit.org/download.html or use the --with-luajit-*
- options if you have it installed inn an unusual place. You can
- also set the LUA_DIR environment variablet to the daqs root installation directory\n"
-)
-
-
-find_path(LUAJIT_INCLUDE_DIR
- NAMES luajit.h
- HINTS ENV LUA_DIR
- PATH_SUFFIXES include include/luajit-2.0
- PATHS ${LUA_PATHS}
-)
-
-find_library(LUAJIT_LIBRARIES
- NAMES luajit-5.1
- HINTS ${LUAJIT_LIBRARIES_DIR}
- DOC "Lua Libraries"
- NO_DEFAULT_PATH
- NO_CMAKE_ENVIRONMENT_PATH
-)
-find_library(LUAJIT_LIBRARIES
- NAMES luajit-5.1
- HINTS ENV LUA_DIR
- PATH_SUFFIXES luajit-5.1
- PATHS ${LUA_PATHS}
- DOC "Lua Libraries"
-)
-
-if (APPLE)
- set(CMAKE_EXE_LINKER_FLAGS "${CMAKE_EXE_LINKER_FLAGS} ${LUAJIT_LIBRARIES} -pagezero_size 10000 -image_base 100000000")
-endif()
-
-if(LUAJIT_LIBRARIES)
- # include the math library for Unix
- if(UNIX AND NOT APPLE)
- find_library(MATH_LIBRARY m)
- list(APPEND LUAJIT_LIBRARIES "${MATH_LIBRARY}")
- endif()
-endif()
-
-
-if(LUAJIT_INCLUDE_DIR AND EXISTS "${LUAJIT_INCLUDE_DIR}/luajit.h")
- file(STRINGS "${LUAJIT_INCLUDE_DIR}/luajit.h" luajit_version_str REGEX "^#define[ \t]+LUAJIT_VERSION[ \t]+\"LuaJIT .+\"")
-
- string(REGEX REPLACE "^#define[ \t]+LUAJIT_VERSION[ \t]+\"LuaJIT ([^\"]+)\".*" "\\1" LUAJIT_VERSION_STRING "${luajit_version_str}")
- unset(luajit_version_str)
-endif()
-
-include(FindPackageHandleStandardArgs)
-# handle the QUIETLY and REQUIRED arguments and set LUA_FOUND to TRUE if
-# all listed variables are TRUE
-find_package_handle_standard_args(LuaJIT
- REQUIRED_VARS LUAJIT_LIBRARIES LUAJIT_INCLUDE_DIR
- VERSION_VAR LUAJIT_VERSION_STRING
- FAIL_MESSAGE "${ERROR_MESSAGE}"
-)
-
-mark_as_advanced(
- LUAJIT_INCLUDE_DIR
- LUAJIT_LIBRARIES
- MATH_LIBRARY
-)
-
+++ /dev/null
-#
-# SNORT_FOUND - Found Snort
-# SNORT_EXECUTABLE - The Snort++ executable
-# SNORT_INCLUDE_DIR - Snort include directory
-#
-#
-# These varaibles are all lists whose variables are retrieved from either
-# snort.cmake or pkg-config. snort.cmake will always take precendence over pkg-config.
-# SNORT_INTERFACE_COMPILE_OPTIONS - a list of Snort++'s compile options.
-# SNORT_INTERFACE_INCLUDE_DIRECTORIES - The directories that Snort++ includes
-# when building.
-# SNORT_INTERFACE_LINK_FLAGS - Snort++ link flags. only available with `pkg-config`
-#
-
-set(ERROR_MESSAGE
- "
- Unable to find Snort. Either
-
- 1) Using ccmake, manually set the cmake variables
- SNORT_INCLUDE_DIR and SNORT_EXECUTABLE.
-
- 2) run cmake with the following arguments
- -DSNORT_INCLUDE_DIR:PATH=/full/path/to/snort/include/dir
- -DSNORT_EXECUTABLE:PATH=/full/path/to/snort/binary
-
- 3) set the environment variable SNORT_DIR to the root
- root installation directory.
-
- 4) Find the file snort.cmake. Manually set set the
- variable SNORT_IMPORT_FILE using either ccmake or the
- command line (-DSNORT_IMPORT_FILE=/full/install/path/lib/snort/snort.cmake)
-
- 5) install pkg-config and add the path to snort.pc to the PKG_CONFIG_PATH
- environment variable.
-
- "
-)
-
-
-# First, lets try to import the Snort
-find_file (SNORT_IMPORT_FILE
- NAMES snort.cmake
- HINTS ENV SNORT_DIR
- PATH_SUFFIXES lib lib/snort snort
-)
-
-if (SNORT_IMPORT_FILE)
- include (${SNORT_IMPORT_FILE})
-
- if (NOT SNORT_EXECUTABLE)
- get_target_property(tmp_exe snort LOCATION)
- set(SNORT_EXECUTABLE "${tmp_exe}" CACHE FILEPATH "Snort executable" FORCE)
- endif()
-
- get_target_property(tmp_cflags snort INTERFACE_COMPILE_OPTIONS)
- set (SNORT_INTERFACE_COMPILE_OPTIONS "${tmp_cflags}" CACHE STRING
- "The compile options with which Snort was linked" FORCE)
-
- get_target_property(tmp_int_dir snort INTERFACE_INCLUDE_DIRECTORIES)
- set(SNORT_INTERFACE_INCLUDE_DIRECTORIES "${tmp_int_dir}" CACHE FILEPATH
- "The directories that Snort include's when building" FORCE)
-
-
-endif(SNORT_IMPORT_FILE)
-
-
-
-find_package(PkgConfig QUIET)
-
-if (PKG_CONFIG_FOUND)
- pkg_check_modules(SNORT_PKG snort)
-
- if (SNORT_PKG_FOUND)
-
- # CMake file takes precedence over pkg-config file
- if (NOT SNORT_INTERFACE_COMPILE_OPTIONS)
- set (SNORT_INTERFACE_COMPILE_OPTIONS "${SNORT_PKG_CFLAGS_OTHER}" CACHE STRING
- "The compile options with which Snort was linked" FORCE)
- endif()
-
- if (NOT SNORT_INTERFACE_INCLUDE_DIRECTORIES)
- set (SNORT_INTERFACE_INCLUDE_DIRECTORIES "${SNORT_PKG_INCLUDE_DIRS}" CACHE STRING
- "The compile options with which Snort was linked" FORCE)
- endif()
-
- # add Snort link flags
- set (SNORT_INTERFACE_LINK_FLAGS "${SNORT_PKG_LDFLAGS}"
- CACHE STRING "The link flags with which the Snort++ binary was linked" FORCE)
-
-
- if (CMAKE_INSTALL_PREFIX_INITIALIZED_TO_DEFAULT)
- set (CMAKE_INSTALL_PREFIX "${SNORT_PKG_PREFIX}" CACHE PATH
- "Install path prefix, prepended onto install directories." FORCE)
- endif (CMAKE_INSTALL_PREFIX_INITIALIZED_TO_DEFAULT)
-
- endif (SNORT_PKG_FOUND)
-endif (PKG_CONFIG_FOUND)
-
-
-find_path (SNORT_INCLUDE_DIR
- NAMES main/snort_types.h
- HINTS ${SNORT_INTERFACE_INCLUDE_DIRECTORIES} ENV SNORT_DIR
- PATH_SUFFIXES snort include/snort
-)
-
-find_program (SNORT_EXECUTABLE
- NAMES snort
- HINTS ${SNORT_PKG_PREFIX} ENV SNORT_DIR
- PATH_SUFFIXES bin # necessary when SNORT_DIR is set
-)
-
-include(FindPackageHandleStandardArgs)
-find_package_handle_standard_args( Snort
- REQUIRED_VARS SNORT_INCLUDE_DIR SNORT_EXECUTABLE
- FAIL_MESSAGE "${ERROR_MESSAGE}"
-)
-
-
-mark_as_advanced(
- SNORT_INCLUDE_DIR
- SNORT_EXECUTABLE
- SNORT_IMPORT_FILE
- SNORT_INTERFACE_COMPILE_OPTIONS
- SNORT_INTERFACE_INCLUDE_DIRECTORIES
- SNORT_INTERFACE_LINK_FLAGS
-)
-
-
+++ /dev/null
-*****************************************************************************
-The text that follows is the GNU General Public License, Version 2 (GPL V2)
-and governs your use, modification and/or distribution of SNORT.
-
-Section 9 of the GPL V2 acknowledges that the Free Software Foundation may
-publish revised and/or new versions of the GPL V2 from time to time. Section 9
-further states that a licensee of a program subject to the GPL V2 could be
-free to use any such revised and/or new versions under two different scenarios:
-
-1. "Failure to Specify." Section 9 of the GPL V2 allows a licensee of a
-program governed by an unspecified version of the General Public License to
-choose any version of the General Public License ever published by the Free
-Software Foundation to govern his or her use of such program.
-
-This provision is not applicable to your use of SNORT because we have
-expressly stated in a number of instances that any third party's use,
-modification or distribution of SNORT is governed by GPL V2.
-
-2. "Any Later Version." At the end of the terms and condition of the GPL V2 is
-a section called "How to Apply these Terms to Your New Program," which
-provides guidance to a developer on how to apply the GPL V2 to a third party's
-use, modification and/or distribution of his/her program. Among other things,
-this guidance suggests that the developer attach certain notices to the
-program. Of particular importance is the following notice:
-
-"This program is free software; you can redistribute it and/or modify it under
-the terms of the GNU General Public License as published by the Free Software
-Foundation; either version 2 of the License, or (at your option) any later
-version."
-
-Thus if a developer follows strictly the guidance provided by the Free
-Software Foundation, Section 9 of the GPL V2 provides the licensee the option
-to either use, modify or distribute the program under GPL V2 or under any
-later version published by the Free Software Foundation.
-
-SNORT is an open source project that is governed exclusively by the GPL V2
-and any third party desiring to use, modify or distribute SNORT must do so by
-strictly following the terms and conditions of GPL V2. Anyone using, modifying
-or distributing SNORT does not have the option to chose to use, modify or
-distribute SNORT under any revised or new version of the GPL, including
-without limitation, the GNU General Public License Version 3.
-
-For ease of reference, the comparable notice that is used with SNORT
-(contained in the 'README' file) is as follows:
-
-"This program is free software; you can redistribute it and/or modify it under
-the terms of the GNU General Public License Version 2 as published by the Free
-Software Foundation. You may not use, modify or distribute this program under
-any other version of the GNU General Public License."
-
-If you have any questions about this statement, please feel free to email
-snort-info@snort.org.
-*****************************************************************************
-
- GNU GENERAL PUBLIC LICENSE
- Version 2, June 1991
-
- Copyright (C) 1989, 1991 Free Software Foundation, Inc.
- 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA
- Everyone is permitted to copy and distribute verbatim copies
- of this license document, but changing it is not allowed.
-
- Preamble
-
- The licenses for most software are designed to take away your
-freedom to share and change it. By contrast, the GNU General Public
-License is intended to guarantee your freedom to share and change free
-software--to make sure the software is free for all its users. This
-General Public License applies to most of the Free Software
-Foundation's software and to any other program whose authors commit to
-using it. (Some other Free Software Foundation software is covered by
-the GNU Library General Public License instead.) You can apply it to
-your programs, too.
-
- When we speak of free software, we are referring to freedom, not
-price. Our General Public Licenses are designed to make sure that you
-have the freedom to distribute copies of free software (and charge for
-this service if you wish), that you receive source code or can get it
-if you want it, that you can change the software or use pieces of it
-in new free programs; and that you know you can do these things.
-
- To protect your rights, we need to make restrictions that forbid
-anyone to deny you these rights or to ask you to surrender the rights.
-These restrictions translate to certain responsibilities for you if you
-distribute copies of the software, or if you modify it.
-
- For example, if you distribute copies of such a program, whether
-gratis or for a fee, you must give the recipients all the rights that
-you have. You must make sure that they, too, receive or can get the
-source code. And you must show them these terms so they know their
-rights.
-
- We protect your rights with two steps: (1) copyright the software, and
-(2) offer you this license which gives you legal permission to copy,
-distribute and/or modify the software.
-
- Also, for each author's protection and ours, we want to make certain
-that everyone understands that there is no warranty for this free
-software. If the software is modified by someone else and passed on, we
-want its recipients to know that what they have is not the original, so
-that any problems introduced by others will not reflect on the original
-authors' reputations.
-
- Finally, any free program is threatened constantly by software
-patents. We wish to avoid the danger that redistributors of a free
-program will individually obtain patent licenses, in effect making the
-program proprietary. To prevent this, we have made it clear that any
-patent must be licensed for everyone's free use or not licensed at all.
-
- The precise terms and conditions for copying, distribution and
-modification follow.
-\f
- GNU GENERAL PUBLIC LICENSE
- TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
-
- 0. This License applies to any program or other work which contains
-a notice placed by the copyright holder saying it may be distributed
-under the terms of this General Public License. The "Program", below,
-refers to any such program or work, and a "work based on the Program"
-means either the Program or any derivative work under copyright law:
-that is to say, a work containing the Program or a portion of it,
-either verbatim or with modifications and/or translated into another
-language. (Hereinafter, translation is included without limitation in
-the term "modification".) Each licensee is addressed as "you".
-
-Activities other than copying, distribution and modification are not
-covered by this License; they are outside its scope. The act of
-running the Program is not restricted, and the output from the Program
-is covered only if its contents constitute a work based on the
-Program (independent of having been made by running the Program).
-Whether that is true depends on what the Program does.
-
- 1. You may copy and distribute verbatim copies of the Program's
-source code as you receive it, in any medium, provided that you
-conspicuously and appropriately publish on each copy an appropriate
-copyright notice and disclaimer of warranty; keep intact all the
-notices that refer to this License and to the absence of any warranty;
-and give any other recipients of the Program a copy of this License
-along with the Program.
-
-You may charge a fee for the physical act of transferring a copy, and
-you may at your option offer warranty protection in exchange for a fee.
-
- 2. You may modify your copy or copies of the Program or any portion
-of it, thus forming a work based on the Program, and copy and
-distribute such modifications or work under the terms of Section 1
-above, provided that you also meet all of these conditions:
-
- a) You must cause the modified files to carry prominent notices
- stating that you changed the files and the date of any change.
-
- b) You must cause any work that you distribute or publish, that in
- whole or in part contains or is derived from the Program or any
- part thereof, to be licensed as a whole at no charge to all third
- parties under the terms of this License.
-
- c) If the modified program normally reads commands interactively
- when run, you must cause it, when started running for such
- interactive use in the most ordinary way, to print or display an
- announcement including an appropriate copyright notice and a
- notice that there is no warranty (or else, saying that you provide
- a warranty) and that users may redistribute the program under
- these conditions, and telling the user how to view a copy of this
- License. (Exception: if the Program itself is interactive but
- does not normally print such an announcement, your work based on
- the Program is not required to print an announcement.)
-\f
-These requirements apply to the modified work as a whole. If
-identifiable sections of that work are not derived from the Program,
-and can be reasonably considered independent and separate works in
-themselves, then this License, and its terms, do not apply to those
-sections when you distribute them as separate works. But when you
-distribute the same sections as part of a whole which is a work based
-on the Program, the distribution of the whole must be on the terms of
-this License, whose permissions for other licensees extend to the
-entire whole, and thus to each and every part regardless of who wrote it.
-
-Thus, it is not the intent of this section to claim rights or contest
-your rights to work written entirely by you; rather, the intent is to
-exercise the right to control the distribution of derivative or
-collective works based on the Program.
-
-In addition, mere aggregation of another work not based on the Program
-with the Program (or with a work based on the Program) on a volume of
-a storage or distribution medium does not bring the other work under
-the scope of this License.
-
- 3. You may copy and distribute the Program (or a work based on it,
-under Section 2) in object code or executable form under the terms of
-Sections 1 and 2 above provided that you also do one of the following:
-
- a) Accompany it with the complete corresponding machine-readable
- source code, which must be distributed under the terms of Sections
- 1 and 2 above on a medium customarily used for software interchange; or,
-
- b) Accompany it with a written offer, valid for at least three
- years, to give any third party, for a charge no more than your
- cost of physically performing source distribution, a complete
- machine-readable copy of the corresponding source code, to be
- distributed under the terms of Sections 1 and 2 above on a medium
- customarily used for software interchange; or,
-
- c) Accompany it with the information you received as to the offer
- to distribute corresponding source code. (This alternative is
- allowed only for noncommercial distribution and only if you
- received the program in object code or executable form with such
- an offer, in accord with Subsection b above.)
-
-The source code for a work means the preferred form of the work for
-making modifications to it. For an executable work, complete source
-code means all the source code for all modules it contains, plus any
-associated interface definition files, plus the scripts used to
-control compilation and installation of the executable. However, as a
-special exception, the source code distributed need not include
-anything that is normally distributed (in either source or binary
-form) with the major components (compiler, kernel, and so on) of the
-operating system on which the executable runs, unless that component
-itself accompanies the executable.
-
-If distribution of executable or object code is made by offering
-access to copy from a designated place, then offering equivalent
-access to copy the source code from the same place counts as
-distribution of the source code, even though third parties are not
-compelled to copy the source along with the object code.
-\f
- 4. You may not copy, modify, sublicense, or distribute the Program
-except as expressly provided under this License. Any attempt
-otherwise to copy, modify, sublicense or distribute the Program is
-void, and will automatically terminate your rights under this License.
-However, parties who have received copies, or rights, from you under
-this License will not have their licenses terminated so long as such
-parties remain in full compliance.
-
- 5. You are not required to accept this License, since you have not
-signed it. However, nothing else grants you permission to modify or
-distribute the Program or its derivative works. These actions are
-prohibited by law if you do not accept this License. Therefore, by
-modifying or distributing the Program (or any work based on the
-Program), you indicate your acceptance of this License to do so, and
-all its terms and conditions for copying, distributing or modifying
-the Program or works based on it.
-
- 6. Each time you redistribute the Program (or any work based on the
-Program), the recipient automatically receives a license from the
-original licensor to copy, distribute or modify the Program subject to
-these terms and conditions. You may not impose any further
-restrictions on the recipients' exercise of the rights granted herein.
-You are not responsible for enforcing compliance by third parties to
-this License.
-
- 7. If, as a consequence of a court judgment or allegation of patent
-infringement or for any other reason (not limited to patent issues),
-conditions are imposed on you (whether by court order, agreement or
-otherwise) that contradict the conditions of this License, they do not
-excuse you from the conditions of this License. If you cannot
-distribute so as to satisfy simultaneously your obligations under this
-License and any other pertinent obligations, then as a consequence you
-may not distribute the Program at all. For example, if a patent
-license would not permit royalty-free redistribution of the Program by
-all those who receive copies directly or indirectly through you, then
-the only way you could satisfy both it and this License would be to
-refrain entirely from distribution of the Program.
-
-If any portion of this section is held invalid or unenforceable under
-any particular circumstance, the balance of the section is intended to
-apply and the section as a whole is intended to apply in other
-circumstances.
-
-It is not the purpose of this section to induce you to infringe any
-patents or other property right claims or to contest validity of any
-such claims; this section has the sole purpose of protecting the
-integrity of the free software distribution system, which is
-implemented by public license practices. Many people have made
-generous contributions to the wide range of software distributed
-through that system in reliance on consistent application of that
-system; it is up to the author/donor to decide if he or she is willing
-to distribute software through any other system and a licensee cannot
-impose that choice.
-
-This section is intended to make thoroughly clear what is believed to
-be a consequence of the rest of this License.
-\f
- 8. If the distribution and/or use of the Program is restricted in
-certain countries either by patents or by copyrighted interfaces, the
-original copyright holder who places the Program under this License
-may add an explicit geographical distribution limitation excluding
-those countries, so that distribution is permitted only in or among
-countries not thus excluded. In such case, this License incorporates
-the limitation as if written in the body of this License.
-
- 9. The Free Software Foundation may publish revised and/or new versions
-of the General Public License from time to time. Such new versions will
-be similar in spirit to the present version, but may differ in detail to
-address new problems or concerns.
-
-Each version is given a distinguishing version number. If the Program
-specifies a version number of this License which applies to it and "any
-later version", you have the option of following the terms and conditions
-either of that version or of any later version published by the Free
-Software Foundation. If the Program does not specify a version number of
-this License, you may choose any version ever published by the Free Software
-Foundation.
-
- 10. If you wish to incorporate parts of the Program into other free
-programs whose distribution conditions are different, write to the author
-to ask for permission. For software which is copyrighted by the Free
-Software Foundation, write to the Free Software Foundation; we sometimes
-make exceptions for this. Our decision will be guided by the two goals
-of preserving the free status of all derivatives of our free software and
-of promoting the sharing and reuse of software generally.
-
- NO WARRANTY
-
- 11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
-FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN
-OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
-PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
-OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
-MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS
-TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE
-PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
-REPAIR OR CORRECTION.
-
- 12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
-WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
-REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
-INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
-OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
-TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
-YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
-PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
-POSSIBILITY OF SUCH DAMAGES.
-
- END OF TERMS AND CONDITIONS
-\f
- How to Apply These Terms to Your New Programs
-
- If you develop a new program, and you want it to be of the greatest
-possible use to the public, the best way to achieve this is to make it
-free software which everyone can redistribute and change under these terms.
-
- To do so, attach the following notices to the program. It is safest
-to attach them to the start of each source file to most effectively
-convey the exclusion of warranty; and each file should have at least
-the "copyright" line and a pointer to where the full notice is found.
-
- <one line to give the program's name and a brief idea of what it does.>
- Copyright (C) 19yy <name of author>
-
- This program is free software; you can redistribute it and/or modify
- it under the terms of the GNU General Public License as published by
- the Free Software Foundation; either version 2 of the License, or
- (at your option) any later version.
-
- This program is distributed in the hope that it will be useful,
- but WITHOUT ANY WARRANTY; without even the implied warranty of
- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- GNU General Public License for more details.
-
- You should have received a copy of the GNU General Public License
- along with this program; if not, write to the Free Software
- Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
- USA
-
-
-Also add information on how to contact you by electronic and paper mail.
-
-If the program is interactive, make it output a short notice like this
-when it starts in an interactive mode:
-
- Gnomovision version 69, Copyright (C) 19yy name of author
- Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
- This is free software, and you are welcome to redistribute it
- under certain conditions; type `show c' for details.
-
-The hypothetical commands `show w' and `show c' should show the appropriate
-parts of the General Public License. Of course, the commands you use may
-be called something other than `show w' and `show c'; they could even be
-mouse-clicks or menu items--whatever suits your program.
-
-You should also get your employer (if you work as a programmer) or your
-school, if any, to sign a "copyright disclaimer" for the program, if
-necessary. Here is a sample; alter the names:
-
- Yoyodyne, Inc., hereby disclaims all copyright interest in the program
- `Gnomovision' (which makes passes at compilers) written by James Hacker.
-
- <signature of Ty Coon>, 1 April 1989
- Ty Coon, President of Vice
-
-This General Public License does not permit incorporating your program into
-proprietary programs. If your program is a subroutine library, you may
-consider it more useful to permit linking proprietary applications with the
-library. If this is what you want to do, use the GNU Library General
-Public License instead of this License.
+++ /dev/null
-
-EXTRA_DIST = \
-README \
-COPYING \
-LICENSE
-
-SUBDIRS = \
-src
-
-AM_CXXFLAGS = @AM_CXXFLAGS@
-
-DISTCLEANFILES = \
-compile \
-config.guess \
-config.sub \
-depcomp \
-install-sh \
-ltmain.sh \
-missing
-
+++ /dev/null
-Snort++ Extras
-
-Snort++ is all about plugins. It has over 200 by default and makes it easy
-to add more in C++ or LuaJIT. This file will walk you through building and
-running a set of extra example plugins. If you haven't installed and
-verified Snort++, you will need to do that first. We will cover the
-following topics:
-
-* Overview
-* Download
-* Build Extras
-* Run Extras
-* Next Steps
-
-OVERVIEW
-
-The following things are pluggable in Snort++:
-
-* codec - decode and encode support for a given protocol
-* data - additional configuration for inspectors
-* inspector - replaces Snort preprocessors
-* ips_option - IPS rule option like content and byte_test
-* ips_action - IPS rule action like alert and block
-* search_engine - fast pattern matcher
-* logger - event handers
-* SO rules - dynamic rules
-
-DOWNLOAD
-
-There are two extra tarballs, one for autotools and one for cmake:
-
- snort_extra-1.0.0-a1-130-auto.tar.gz
- snort_extra-1.0.0-a1-130-cmake.tar.gz
-
-If you cloned from github, you have already have everything.
-
-BUILD EXTRAS
-
-Follow these steps:
-
-1. Set up source directory:
-
-* If you are using a github clone:
-
- cd extra/
-
-* Otherwise do this:
-
- tar zxf extra-tarball
- cd snort_extra-1.0.0*
-
-2. Setup install path (same as for snort):
-
- export my_path=/path/to/snorty
- export PKG_CONFIG_PATH=$my_path/lib/pkgconfig
-
-3. Compile and install:
-
-* To build with autotools, simply do the usual from the top level directory:
-
- ./configure --prefix=$my_path
- make -j 8 install
-
-* To build with cmake and make, run configure_cmake.sh. It will automatically create and populate a new subdirectory named 'build'.
-
- ./configure_cmake.sh --prefix=$my_path
- cd build
- make -j 8 install
-
-Note:
-
-* If you are using autotools with a github clone, first do autoreconf -isvf.
-* If you are familiar with cmake, you can run cmake/ccmake instead of
- configure_cmake.sh.
-* cmake --help will list any available generators, such as Xcode. Feel
- free to use one, however help with those will be provided separately.
-
-RUN EXTRAS
-
-In the following, replace a.pcap with your favorite.
-
-* The following demonstrates a C++ logger and a LuaJIT logger:
-
- $my_path/bin/snort -c $my_path/etc/snort/snort.lua -R $my_path/etc/snort/sample.rules \
- -r a.pcap --plugin-path $my_path/lib/snort_extra -A alert_ex
-
- $my_path/bin/snort -c $my_path/etc/snort/snort.lua -R $my_path/etc/snort/sample.rules \
- -r a.pcap --script-path $my_path/lib/snort_extra -A lualert
-
-You can edit $my_path/lib/snort_extra/loggers/alert.lua to tweak the output
-format and rerun the above command to try it out.
-
-* The last example demonstrates a LuaJIT rule option called find. The rule,
- supplied on stdin, uses the Lua [[ multiline string ]] delimiters to avoid
- shell escape issues:
-
- echo 'alert tcp any any -> any 80 ( sid:1; msg:"test"; http_method; find:"pat = [[GET]]"; )' | \
- $my_path/bin/snort -c $my_path/etc/snort/snort.lua -r a.pcap \
- -A cmg --script-path $my_path/lib/snort_extra --stdin-rules
-
-NEXT STEPS o")~
-
-There is no design guide yet but you can develop your own plugins in C++ by
-using the examples as a starting point. In addition, IPS options and
-loggers can also be written in LuaJIT. The API may change going forward,
-but you are encouraged to roll your own now and let us know how it goes so
-we can incorporate any suggestions in the final design.
-
+++ /dev/null
-if(NOT EXISTS "@CMAKE_CURRENT_BINARY_DIR@/install_manifest.txt")
- message(FATAL_ERROR "Cannot find install manifest: @CMAKE_CURRENT_BINARY_DIR@/install_manifest.txt")
-endif(NOT EXISTS "@CMAKE_CURRENT_BINARY_DIR@/install_manifest.txt")
-
-file(READ "@CMAKE_CURRENT_BINARY_DIR@/install_manifest.txt" files)
-string(REGEX REPLACE "\n" ";" files "${files}")
-foreach(file ${files})
- message(STATUS "Uninstalling $ENV{DESTDIR}${file}")
- if(IS_SYMLINK "$ENV{DESTDIR}${file}" OR EXISTS "$ENV{DESTDIR}${file}")
- exec_program(
- "@CMAKE_COMMAND@" ARGS "-E remove \"$ENV{DESTDIR}${file}\""
- OUTPUT_VARIABLE rm_out
- RETURN_VALUE rm_retval
- )
- if(NOT "${rm_retval}" STREQUAL 0)
- message(FATAL_ERROR "Problem when removing $ENV{DESTDIR}${file}")
- endif(NOT "${rm_retval}" STREQUAL 0)
- else(IS_SYMLINK "$ENV{DESTDIR}${file}" OR EXISTS "$ENV{DESTDIR}${file}")
- message(STATUS "File $ENV{DESTDIR}${file} does not exist.")
- endif(IS_SYMLINK "$ENV{DESTDIR}${file}" OR EXISTS "$ENV{DESTDIR}${file}")
-endforeach(file)
\ No newline at end of file
+++ /dev/null
-#--------------------------------------------------------------------------
-# initialization
-#--------------------------------------------------------------------------
-
-AC_INIT([snort_extra], [1.0.0-a4], [snort-team@sourcefire.com])
-AC_PREREQ(2.69)
-
-AC_CONFIG_SRCDIR([config.h.in])
-AC_CONFIG_MACRO_DIR([m4])
-AC_CONFIG_HEADERS([config.h])
-
-AM_INIT_AUTOMAKE(foreign)
-AM_SILENT_RULES([yes])
-
-# Checks for programs.
-AC_PROG_CC([clang gcc])
-AC_PROG_CXX([clang++ g++])
-AC_PROG_LIBTOOL
-
-LT_INIT
-
-# Use the same defines Snort used
-# (absolutely critical to ensure struct definitions match)
-CPPFLAGS="$CPPFLAGS `pkg-config --cflags snort`"
-
-CPPFLAGS="$CPPFLAGS -DBUILDING_SO"
-
-CFLAGS="$CFLAGS -std=gnu99"
-CXXFLAGS="$CXXFLAGS -std=c++11"
-
-AX_CXX_COMPILE_STDCXX_11
-
-#--------------------------------------------------------------------------
-# visibility foo
-#--------------------------------------------------------------------------
-
-# modified from gnulib/m4/visibility.m4
-AC_DEFUN([CC_VISIBILITY],
-[
- AC_REQUIRE([AC_PROG_CC])
- AC_MSG_CHECKING([for visibility support])
- gl_save_CFLAGS="$CFLAGS"
-
- AC_CACHE_VAL(gl_cv_cc_visibility, [
- # Add -Werror flag since some compilers, e.g. icc 7.1, don't support it,
- # but only warn about it instead of compilation failing
- CFLAGS="$CFLAGS -Werror -fvisibility=hidden"
- AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
- extern __attribute__((__visibility__("hidden"))) int hiddenvar;
- extern __attribute__((__visibility__("default"))) int exportedvar;
- extern __attribute__((__visibility__("hidden"))) int hiddenfunc (void);
- extern __attribute__((__visibility__("default"))) int exportedfunc (void);]],
- [[]])],
- [gl_cv_cc_visibility="yes"],
- [gl_cv_cc_visibility="no"])
- ])
- AC_MSG_RESULT([$gl_cv_cc_visibility])
- CFLAGS="$gl_save_CFLAGS"
- if test "x$gl_cv_cc_visibility" = "xyes"; then
- # flags pulled from snort but we need to define the have
- #CFLAGS="$CFLAGS -fvisibility=hidden"
- #CXXFLAGS="$CXXFLAGS -fvisibility=hidden"
- AC_DEFINE([HAVE_VISIBILITY],[1],
- [Define if the compiler supports visibility declarations.])
- fi
-])
-CC_VISIBILITY()
-
-#--------------------------------------------------------------------------
-# outputs
-#--------------------------------------------------------------------------
-
-AC_SUBST(AM_CXXFLAGS)
-
-AC_CONFIG_FILES([ \
- Makefile \
- src/Makefile \
- src/codecs/Makefile \
- src/daqs/Makefile \
- src/inspectors/Makefile \
- src/ips_options/Makefile \
- src/loggers/Makefile \
- src/search_engines/Makefile \
- src/so_rules/Makefile \
-])
-
-AC_OUTPUT
-
-AC_MSG_RESULT([
- $PACKAGE $VERSION
- ========
-
- prefix: ${prefix}
- sysconfdir: ${sysconfdir}
- libdir: ${libdir}
- includedir: ${includedir}
-
- compiler: ${CC}
- compiler++: ${CXX}
- cflags: ${CFLAGS}
- cxxflags: ${CXXFLAGS}
- cppflags: ${CPPFLAGS}
- ldflags: ${LDFLAGS}
- libs: ${LIBS}
-])
+++ /dev/null
-#!/bin/sh
-# Convenience wrapper for easily viewing/setting options that
-# the project's CMake scripts will recognize
-set -e
-command="$0 $*"
-
-# check for `cmake` command
-type cmake > /dev/null 2>&1 || {
- echo "\
-This package requires CMake, please install it first, then you may
-use this configure script to access CMake equivalent functionality.\
-" >&2;
- exit 1;
-}
-
-usage="\
-Usage: $0 [OPTION]... [VAR=VALUE]...
-
- --builddir= The build directory
- --generator= run cmake --help for a list of generators
- --prefix= Snort++ installation prefix
-
- Optional Packages:
- --with-daq-includes=DIR DAQ include directory
- --with-daq-libraries=DIR DAQ library directory
- --with-luajit-includes=DIR luajit include directory
- --with-luajit-libraries=DIR luajit library directory
-"
-
-sourcedir="$( cd "$( dirname "$0" )" && pwd )"
-
-# Function to append a CMake cache entry definition to the
-# CMakeCacheEntries variable
-# $1 is the cache entry variable name
-# $2 is the cache entry variable type
-# $3 is the cache entry variable value
-append_cache_entry () {
- CMakeCacheEntries="$CMakeCacheEntries -D $1:$2=$3"
-}
-
-check_and_append_cache_entry() {
- if [ -f $3 ]; then
- append_cache_entry $1 $2 $3
- else
- echo ""
- echo "the $1 variable, which is specified using a --with-* options,"
- echo "requires an absolute path to the library. Could not stat the"
- echo "the library:"
- echo " $3"
- echo ""
- exit 1
- fi
-}
-
-# set defaults
-builddir=build
-prefix=/usr/local/snort
-CMakeCacheEntries=""
-append_cache_entry CMAKE_INSTALL_PREFIX PATH $prefix
-
-
-# parse arguments
-while [ $# -ne 0 ]; do
- case "$1" in
- -*=*) optarg=`echo "$1" | sed 's/[-_a-zA-Z0-9]*=//'` ;;
- *) optarg= ;;
- esac
-
- case "$1" in
- --help|-h)
- echo "${usage}" 1>&2
- exit 1
- ;;
- --builddir=*)
- builddir=$optarg
- ;;
- --generator=*)
- CMakeGenerator="$optarg"
- ;;
- --prefix=*)
- prefix=$optarg
- append_cache_entry CMAKE_INSTALL_PREFIX PATH $optarg
- ;;
- --with-luajit-includes=*)
- append_cache_entry LUAJIT_INCLUDE_DIR PATH $optarg
- ;;
- --with-luajit-libraries=*)
- append_cache_entry LUAJIT_LIBRARIES_DIR PATH $optarg
- ;;
- --with-daq-includes=*)
- append_cache_entry DAQ_INCLUDE_DIR PATH $optarg
- ;;
- --with-daq-libraries=*)
- append_cache_entry DAQ_LIBRARIES_DIR PATH $optarg
- ;;
- *)
- echo "Invalid option '$1'. Try $0 --help to see available options."
- exit 1
- ;;
- esac
- shift
-done
-
-if [ -d $builddir ]; then
- # If build directory exists, check if it has a CMake cache
- if [ -f $builddir/CMakeCache.txt ]; then
- # If the CMake cache exists, delete it so that this configuration
- # is not tainted by a previous one
- rm -f $builddir/CMakeCache.txt
- fi
-else
- # Create build directory
- mkdir -p $builddir
-fi
-
-echo "Build Directory : $builddir"
-echo "Source Directory: $sourcedir"
-cd $builddir
-
-gen=""
-[ "$CMakeGenerator" ] && gen+=" -G $CMakeGenerator"
-
-cmake $gen \
- -DCOMPILE_DEFINITIONS:STRING="$CPPFLAGS" \
- -DCMAKE_CXX_FLAGS:STRING="$CXXFLAGS $CPPFLAGS" \
- -DCMAKE_C_FLAGS:STRING="$CFLAGS $CPPFLAGS" \
- $CMakeCacheEntries $sourcedir
-
-echo "# This is the command used to configure this build" > config.status
-echo $command >> config.status
-chmod u+x config.status
-
+++ /dev/null
-
-add_custom_target(dist
- COMMAND ${CMAKE_COMMAND} --build ${CMAKE_BINARY_DIR} --target package_source
-)
-
-set (AUTOTOOL_FILES "autom4te.cache;m4;configure.ac;Makefile.am")
-
-set (CPACK_GENERATOR TGZ)
-set (CPACK_PACKAGE_NAME "snort_extra")
-set (CPACK_PACKAGE_VENDOR "Cisco")
-set (CPACK_PACKAGE_VERSION_MAJOR "${EXTRA_VERSION_MAJOR}")
-set (CPACK_PACKAGE_VERSION_MINOR "${EXTRA_VERSION_MINOR}")
-set (CPACK_PACKAGE_VERSION_PATCH "${EXTRA_VERSION_BUILD}")
-set (CPACK_PACKAGE_ICON "${CMAKE_SOURCE_DIR}/doc/images/snort.png")
-set (CPACK_PACKAGE_INSTALL_DIRECTORY "snort")
-set (CPACK_RESOURCE_FILE_LICENSE "${CMAKE_SOURCE_DIR}/LICENSE")
-set (CPACK_RESOURCE_FILE_README "${CMAKE_SOURCE_DIR}/README")
-set (CPACK_SOURCE_PACKAGE_FILE_NAME "${CPACK_PACKAGE_NAME}-${CPACK_PACKAGE_VERSION_MAJOR}.${CPACK_PACKAGE_VERSION_MINOR}.${CPACK_PACKAGE_VERSION_PATCH}")
-set (CPACK_SOURCE_IGNORE_FILES "${AUTOTOOL_FILES}")
-set (CPACK_SOURCE_GENERATOR TGZ)
-
-include(CPack)
-
+++ /dev/null
-################################################
-# MACRO FOR ADDING EXAMPLE LIBRARIES
-#
-# Look in subdirecties for examples. This macro
-# will take care of all the logic, especially adding
-# this to the test configuration
-#
-# PARAMS:
-# library ==> library name to be installed
-# install_path ==> install into folder lib/[snort/snort_ex]/install_path
-# SOURCES ==> all arguments after install path are library sources
-#
-################################################
-
-macro (add_example_library libname install_path)
- set (sources ${ARGN})
-
- # Did we get any sources?
- list(LENGTH sources num_extra_args)
- if (${num_extra_args} GREATER 0)
-
- add_library (${libname} SHARED ${sources} )
- set_target_properties ( ${libname}
- PROPERTIES
- COMPILE_FLAGS "-DBUILDING_SO"
- )
-
- # If we're testing plugins, set a variable for later use.
- if (BUILD_EXTRA_PLUGINS)
- set (TMP_PLUGINS "${BUILT_PLUGINS}")
- list (APPEND TMP_PLUGINS ${libname})
-
- # Force implied, but making this explicit
- set (BUILT_PLUGINS "${TMP_PLUGINS}" CACHE INTERNAL "example plugin libraries" FORCE)
- endif (BUILD_EXTRA_PLUGINS)
-
-
- install (TARGETS ${libname}
- LIBRARY DESTINATION "${EX_INSTALL_PATH}/${install_path}"
- )
-
- else (${num_extra_args} GREATER 0)
-
- message (STATUS "add_static_library requires at least one source file!")
- message (FATAL "usage: add_static_library lib_name source_1 source_2 source_3 ...")
-
- endif (${num_extra_args} GREATER 0)
-endmacro (add_example_library)
-
-
-
-################################################
-#### SETTING CORRECT VARIABLES FOR BULIDING ####
-################################################
-
-if (BUILD_EXTRA_PLUGINS)
- set (TEST_INSTALL_DIRECTORY "${CMAKE_CURRENT_BINARY_DIR}/test_install")
- set (EX_INSTALL_PATH "lib/snort")
- include_directories (BEFORE "${TEST_INSTALL_DIRECTORY}/include/snort")
- include_directories (AFTER ${DAQ_INCLUDE_DIR})
-
- # reset this variable in case Cmake is reconfigured. i.e.,
- # we will keep appending the same libraries multiple times otherwise
- unset (BUILT_PLUGINS CACHE)
-
-
-else (BUILD_EXTRA_PLUGINS)
- include_directories (AFTER ${DAQ_INCLUDE_DIR})
- include_directories (BEFORE ${LUAJIT_INCLUDE_DIR})
- include_directories (BEFORE ${SNORT_INCLUDE_DIR})
- set (EX_INSTALL_PATH "lib/snort_extra")
-
-endif (BUILD_EXTRA_PLUGINS)
-
-
-################################################
-####### FINALLY, ADDING SUBDIRECTORIES #######
-################################################
-
-
-add_subdirectory (codecs)
-add_subdirectory (daqs)
-add_subdirectory (inspectors)
-add_subdirectory (ips_options)
-add_subdirectory (loggers)
-add_subdirectory (search_engines)
-add_subdirectory (so_rules)
-
-
-##############################################################################
-# When Testing plugins, I want to build snort, install it, and then include
-# the installed directory. This makes sure we install all correct files.
-# The result is below.
-##############################################################################
-
-if (BUILD_EXTRA_PLUGINS)
-
- ################################################
- # This variable, DBUILD_EXTRA_PLUGINS, is toggled because
- # when Snort++ builds unit test, this directory will
- # get recursively called from 'make install'. Infinite loops
- # seem like a poor life choice.
- ################################################
-
- ################################################
- # Breaking this down by command
- # 1) Remove the previously installed directory (if it exists)
- # While this may strictly not necessary, this is a
- # safegaurd to ensure only current files are included.
- # 2) Clean this directory and all subdirectories. This command
- # works in tandem with WORKING_DIRECTORY to ensure it
- # only cleans extra plugins. Also, we check in the top
- # level cmake file to ensure that Makefiles have been
- # generated. So, the command is definitely valid.
- # 3) Ensure we don't recursively build this directly. Also
- # ensures we install into a temporary directory
- # 4) build snort. Can technically be combined with 'make install'
- # but lets keep them seperate for clarity.
- # 5) install snort into the temp install directory.
- # 6) reset cmake options
- # 7) Another make is required to ensure the all the configured files
- # revert to their original form. I chose u2spewfoo because
- # it only has one source file
- # 8) possible cmake bug? timestamp on installed binary not updating.
- # Manually touch file to ensure we don't needlesly rebuild
- ################################################
-
- set (TMP_INSTALL_PREFIX ${CMAKE_INSTALL_PREFIX})
-
- # install Snort into temporary directory
- add_custom_command(
- OUTPUT "${TEST_INSTALL_DIRECTORY}/bin/snort"
- COMMAND ${CMAKE_COMMAND} -E remove_directory ${TEST_INSTALL_DIRECTORY}
- COMMAND make clean
- COMMAND ${CMAKE_COMMAND} ${CMAKE_BINARY_DIR} -DCMAKE_INSTALL_PREFIX=${TEST_INSTALL_DIRECTORY} -DBUILD_EXTRA_PLUGINS=OFF
-# COMMAND ${CMAKE_COMMAND} --build ${CMAKE_BINARY_DIR} --target snort # performed during --target install
- COMMAND ${CMAKE_COMMAND} --build ${CMAKE_BINARY_DIR} --target install
- COMMAND ${CMAKE_COMMAND} ${CMAKE_BINARY_DIR} -DCMAKE_INSTALL_PREFIX=${TMP_INSTALL_PREFIX} -DBUILD_EXTRA_PLUGINS=ON
- COMMAND ${CMAKE_COMMAND} --build ${CMAKE_BINARY_DIR} --target u2spewfoo
- COMMAND ${CMAKE_COMMAND} -E touch_nocreate ${TEST_INSTALL_DIRECTORY}/bin/snort
- DEPENDS snort
- COMMENT "Building extra plugins using installed Snort"
- WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}
- )
- add_custom_target(install_snort DEPENDS "${TEST_INSTALL_DIRECTORY}/bin/snort")
-
-
- # set in Macro above
- foreach (lib ${BUILT_PLUGINS})
- add_dependencies(${lib} install_snort)
- endforeach(lib)
-endif (BUILD_EXTRA_PLUGINS)
+++ /dev/null
-
-SUBDIRS = \
-codecs \
-daqs \
-inspectors \
-ips_options \
-loggers \
-search_engines \
-so_rules
-
-AM_CXXFLAGS = @AM_CXXFLAGS@
-
+++ /dev/null
-
-add_example_library(cd_eapol codecs cd_eapol.cc)
-add_example_library(cd_i4l_rawip codecs cd_i4l_rawip.cc)
-add_example_library(cd_linux_sll codecs cd_linux_sll.cc)
-add_example_library(cd_null codecs cd_null.cc)
-add_example_library(cd_pflog codecs cd_pflog.cc)
-add_example_library(cd_pim codecs cd_pim.cc)
-add_example_library(cd_ppp codecs cd_ppp.cc)
-add_example_library(cd_raw4 codecs cd_raw4.cc)
-add_example_library(cd_raw6 codecs cd_raw6.cc)
-add_example_library(cd_slip codecs cd_slip.cc)
-add_example_library(cd_token_ring codecs cd_token_ring.cc)
-add_example_library(cd_wlan codecs cd_wlan.cc)
-
+++ /dev/null
-
-cdlibdir = $(pkglibdir)/codecs
-
-cdlib_LTLIBRARIES = libcd_eapol.la
-libcd_eapol_la_CXXFLAGS = $(AM_CXXFLAGS)
-libcd_eapol_la_LDFLAGS = -export-dynamic -shared
-libcd_eapol_la_SOURCES = cd_eapol.cc
-
-cdlib_LTLIBRARIES += libcd_i4l_rawip.la
-libcd_i4l_rawip_la_CXXFLAGS = $(AM_CXXFLAGS)
-libcd_i4l_rawip_la_LDFLAGS = -export-dynamic -shared
-libcd_i4l_rawip_la_SOURCES = cd_i4l_rawip.cc
-
-cdlib_LTLIBRARIES += libcd_linux_sll.la
-libcd_linux_sll_la_CXXFLAGS = $(AM_CXXFLAGS)
-libcd_linux_sll_la_LDFLAGS = -export-dynamic -shared
-libcd_linux_sll_la_SOURCES = cd_linux_sll.cc
-
-cdlib_LTLIBRARIES += libcd_null.la
-libcd_null_la_CXXFLAGS = $(AM_CXXFLAGS)
-libcd_null_la_LDFLAGS = -export-dynamic -shared
-libcd_null_la_SOURCES = cd_null.cc
-
-cdlib_LTLIBRARIES += libcd_pflog.la
-libcd_pflog_la_CXXFLAGS = $(AM_CXXFLAGS)
-libcd_pflog_la_LDFLAGS = -export-dynamic -shared
-libcd_pflog_la_SOURCES = cd_pflog.cc
-
-cdlib_LTLIBRARIES += libcd_pim.la
-libcd_pim_la_CXXFLAGS = $(AM_CXXFLAGS)
-libcd_pim_la_LDFLAGS = -export-dynamic -shared
-libcd_pim_la_SOURCES = cd_pim.cc
-
-cdlib_LTLIBRARIES += libcd_ppp.la
-libcd_ppp_la_CXXFLAGS = $(AM_CXXFLAGS)
-libcd_ppp_la_LDFLAGS = -export-dynamic -shared
-libcd_ppp_la_SOURCES = cd_ppp.cc
-
-cdlib_LTLIBRARIES += libcd_raw4.la
-libcd_raw4_la_CXXFLAGS = $(AM_CXXFLAGS)
-libcd_raw4_la_LDFLAGS = -export-dynamic -shared
-libcd_raw4_la_SOURCES = cd_raw4.cc
-
-cdlib_LTLIBRARIES += libcd_raw6.la
-libcd_raw6_la_CXXFLAGS = $(AM_CXXFLAGS)
-libcd_raw6_la_LDFLAGS = -export-dynamic -shared
-libcd_raw6_la_SOURCES = cd_raw6.cc
-
-cdlib_LTLIBRARIES += libcd_slip.la
-libcd_slip_la_CXXFLAGS = $(AM_CXXFLAGS)
-libcd_slip_la_LDFLAGS = -export-dynamic -shared
-libcd_slip_la_SOURCES = cd_slip.cc
-
-cdlib_LTLIBRARIES += libcd_token_ring.la
-libcd_token_ring_la_CXXFLAGS = $(AM_CXXFLAGS)
-libcd_token_ring_la_LDFLAGS = -export-dynamic -shared
-libcd_token_ring_la_SOURCES = cd_token_ring.cc
-
-cdlib_LTLIBRARIES += libcd_wlan.la
-libcd_wlan_la_CXXFLAGS = $(AM_CXXFLAGS)
-libcd_wlan_la_LDFLAGS = -export-dynamic -shared
-libcd_wlan_la_SOURCES = cd_wlan.cc
-
-AM_CXXFLAGS = @AM_CXXFLAGS@
-
+++ /dev/null
-//--------------------------------------------------------------------------
-// Copyright (C) 2014-2016 Cisco and/or its affiliates. All rights reserved.
-//
-// This program is free software; you can redistribute it and/or modify it
-// under the terms of the GNU General Public License Version 2 as published
-// by the Free Software Foundation. You may not use, modify or distribute
-// this program under any other version of the GNU General Public License.
-//
-// This program is distributed in the hope that it will be useful, but
-// WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
-// General Public License for more details.
-//
-// You should have received a copy of the GNU General Public License along
-// with this program; if not, write to the Free Software Foundation, Inc.,
-// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-//--------------------------------------------------------------------------
-// cd_eapol.cc author Josh Rosenbaum <jrosenba@cisco.com>
-
-#ifdef HAVE_CONFIG_H
-#include "config.h"
-#endif
-
-#include "framework/codec.h"
-#include "codecs/codec_module.h"
-#include "protocols/protocol_ids.h"
-#include "protocols/eapol.h"
-
-#define CD_EAPOL_NAME "eapol"
-#define CD_EAPOL_HELP "support for extensible authentication protocol over LAN"
-
-namespace
-{
-static const RuleMap eapol_rules[] =
-{
- { DECODE_EAPOL_TRUNCATED, "truncated EAP header" },
- { DECODE_EAPKEY_TRUNCATED, "EAP key truncated" },
- { DECODE_EAP_TRUNCATED, "EAP header truncated" },
- { 0, nullptr }
-};
-
-class EapolModule : public CodecModule
-{
-public:
- EapolModule() : CodecModule(CD_EAPOL_NAME, CD_EAPOL_HELP) { }
-
- const RuleMap* get_rules() const override
- { return eapol_rules; }
-};
-
-class EapolCodec : public Codec
-{
-public:
- EapolCodec() : Codec(CD_EAPOL_NAME) { }
- ~EapolCodec() { }
-
- bool decode(const RawData&, CodecData&, DecodeData&) override;
- void get_protocol_ids(std::vector<ProtocolId>&) override;
-
-private:
- void DecodeEAP(const RawData&, const CodecData&);
- void DecodeEapolKey(const RawData&, const CodecData&);
-};
-} // namespace
-
-void EapolCodec::get_protocol_ids(std::vector<ProtocolId>& v)
-{ v.push_back(ProtocolId::ETHERTYPE_EAPOL); }
-
-void EapolCodec::DecodeEAP(const RawData& raw, const CodecData& codec)
-{
- if (raw.len < sizeof(eapol::EAPHdr))
- codec_event(codec, DECODE_EAP_TRUNCATED);
-}
-
-void EapolCodec::DecodeEapolKey(const RawData& raw, const CodecData& codec)
-{
- if (raw.len < sizeof(eapol::EapolKey))
- codec_event(codec, DECODE_EAPKEY_TRUNCATED);
-}
-
-/*************************************************
- ************** main codec functions ************
- *************************************************/
-
-bool EapolCodec::decode(const RawData& raw, CodecData& codec, DecodeData&)
-{
- const eapol::EtherEapol* const eplh =
- reinterpret_cast<const eapol::EtherEapol*>(raw.data);
-
- if (raw.len < sizeof(eapol::EtherEapol))
- {
- codec_event(codec, DECODE_EAPOL_TRUNCATED);
- return false;
- }
-
- if (eplh->eaptype == EAPOL_TYPE_EAP)
- DecodeEAP(raw, codec);
-
- else if (eplh->eaptype == EAPOL_TYPE_KEY)
- DecodeEapolKey(raw, codec);
-
- return true;
-}
-
-//-------------------------------------------------------------------------
-// api
-//-------------------------------------------------------------------------
-
-static Module* mod_ctor()
-{ return new EapolModule; }
-
-static void mod_dtor(Module* m)
-{ delete m; }
-
-static Codec* ctor(Module*)
-{ return new EapolCodec(); }
-
-static void dtor(Codec* cd)
-{ delete cd; }
-
-static const CodecApi eapol_api =
-{
- {
- PT_CODEC,
- sizeof(CodecApi),
- CDAPI_VERSION,
- 0,
- API_RESERVED,
- API_OPTIONS,
- CD_EAPOL_NAME,
- CD_EAPOL_HELP,
- mod_ctor,
- mod_dtor,
- },
- nullptr, // pinit
- nullptr, // pterm
- nullptr, // tinit
- nullptr, // tterm
- ctor, // ctor
- dtor, // dtor
-};
-
-#ifdef BUILDING_SO
-SO_PUBLIC const BaseApi* snort_plugins[] =
-{
- &eapol_api.base,
- nullptr
-};
-#else
-const BaseApi* cd_eapol = &eapol_api.base;
-#endif
-
+++ /dev/null
-//--------------------------------------------------------------------------
-// Copyright (C) 2014-2016 Cisco and/or its affiliates. All rights reserved.
-//
-// This program is free software; you can redistribute it and/or modify it
-// under the terms of the GNU General Public License Version 2 as published
-// by the Free Software Foundation. You may not use, modify or distribute
-// this program under any other version of the GNU General Public License.
-//
-// This program is distributed in the hope that it will be useful, but
-// WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
-// General Public License for more details.
-//
-// You should have received a copy of the GNU General Public License along
-// with this program; if not, write to the Free Software Foundation, Inc.,
-// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-//--------------------------------------------------------------------------
-// cd_i4l_rawip.cc author Josh Rosenbaum <jrosenba@cisco.com>
-
-#ifdef HAVE_CONFIG_H
-#include "config.h"
-#endif
-
-#include <pcap.h>
-#include "framework/codec.h"
-
-#define I4L_RAWIP_NAME "i4l_rawip"
-#define I4L_RAWIP_HELP_STR "support for I4L IP"
-
-#ifdef DLT_I4L_RAWIP
-#define I4L_RAWIP_HELP ADD_DLT(I4L_RAWIP_HELP_STR, DLT_I4L_RAWIP)
-#else
-#define I4L_RAWIP_HELP I4L_RAWIP_HELP_STR
-#endif
-
-namespace
-{
-class I4LRawIpCodec : public Codec
-{
-public:
- I4LRawIpCodec() : Codec(I4L_RAWIP_NAME) { }
- ~I4LRawIpCodec() { }
-
- void get_data_link_type(std::vector<int>&) override;
- bool decode(const RawData&, CodecData&, DecodeData&) override;
-};
-} // namespace
-
-void I4LRawIpCodec::get_data_link_type(std::vector<int>& v)
-{
-#ifdef DLT_I4L_RAWIP
- v.push_back(DLT_I4L_RAWIP);
-#else
- UNUSED(v);
-#endif
-}
-
-bool I4LRawIpCodec::decode(const RawData& raw, CodecData& codec, DecodeData&)
-{
- if (raw.len < 2)
- return false;
-
- codec.lyr_len = 2;
- codec.next_prot_id = ProtocolId::ETHERTYPE_IPV4;
- return true;
-}
-
-//-------------------------------------------------------------------------
-// api
-//-------------------------------------------------------------------------
-
-static Codec* ctor(Module*)
-{ return new I4LRawIpCodec(); }
-
-static void dtor(Codec* cd)
-{ delete cd; }
-
-static const CodecApi i4l_rawip_api =
-{
- {
- PT_CODEC,
- sizeof(CodecApi),
- CDAPI_VERSION,
- 0,
- API_RESERVED,
- API_OPTIONS,
- I4L_RAWIP_NAME,
- I4L_RAWIP_HELP,
- nullptr, // mod_ctor
- nullptr // mod_dtor
- },
- nullptr, // ginit
- nullptr, // gterm
- nullptr, // tinit
- nullptr, // tterm
- ctor,
- dtor,
-};
-
-#ifdef BUILDING_SO
-SO_PUBLIC const BaseApi* snort_plugins[] =
-{
- &i4l_rawip_api.base,
- nullptr
-};
-#else
-const BaseApi* cd_i4l_rawip = &i4l_rawip_api.base;
-#endif
-
+++ /dev/null
-//--------------------------------------------------------------------------
-// Copyright (C) 2014-2016 Cisco and/or its affiliates. All rights reserved.
-//
-// This program is free software; you can redistribute it and/or modify it
-// under the terms of the GNU General Public License Version 2 as published
-// by the Free Software Foundation. You may not use, modify or distribute
-// this program under any other version of the GNU General Public License.
-//
-// This program is distributed in the hope that it will be useful, but
-// WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
-// General Public License for more details.
-//
-// You should have received a copy of the GNU General Public License along
-// with this program; if not, write to the Free Software Foundation, Inc.,
-// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-//--------------------------------------------------------------------------
-// cd_linux_sll.cc author Josh Rosenbaum <jrosenba@cisco.com>
-
-#ifdef HAVE_CONFIG_H
-#include "config.h"
-#endif
-
-#include <pcap.h>
-#include "framework/codec.h"
-#include "protocols/linux_sll.h"
-
-#define CD_LINUX_SLL_NAME "linux_sll"
-#define CD_LINUX_SLL_HELP_STR "support for Linux SLL"
-#define CD_LINUX_SLL_HELP ADD_DLT(CD_LINUX_SLL_HELP_STR, DLT_LINUX_SLL)
-
-namespace
-{
-class LinuxSllCodec : public Codec
-{
-public:
- LinuxSllCodec() : Codec(CD_LINUX_SLL_NAME) { }
- ~LinuxSllCodec() { }
-
- void get_data_link_type(std::vector<int>&) override;
- bool decode(const RawData&, CodecData&, DecodeData&) override;
-};
-} // namespace
-
-void LinuxSllCodec::get_data_link_type(std::vector<int>& v)
-{
-#ifdef DLT_LINUX_SLL
- v.push_back(DLT_LINUX_SLL);
-#endif
-}
-
-bool LinuxSllCodec::decode(const RawData& raw, CodecData& data, DecodeData&)
-{
- /* do a little validation */
- if (raw.len < linux_sll::SLL_HDR_LEN)
- return false;
-
- /* lay the ethernet structure over the packet data */
- const linux_sll::SLLHdr* const sllh = reinterpret_cast<const linux_sll::SLLHdr*>(raw.data);
-
- /* grab out the network type */
- data.next_prot_id = (ProtocolId)ntohs(sllh->sll_protocol);
- data.lyr_len = linux_sll::SLL_HDR_LEN;
- return true;
-}
-
-//-------------------------------------------------------------------------
-// api
-//-------------------------------------------------------------------------
-
-static Codec* ctor(Module*)
-{ return new LinuxSllCodec(); }
-
-static void dtor(Codec* cd)
-{ delete cd; }
-
-static const CodecApi linux_ssl_api =
-{
- {
- PT_CODEC,
- sizeof(CodecApi),
- CDAPI_VERSION,
- 0,
- API_RESERVED,
- API_OPTIONS,
- CD_LINUX_SLL_NAME,
- CD_LINUX_SLL_HELP,
- nullptr,
- nullptr,
- },
- nullptr,
- nullptr,
- nullptr,
- nullptr,
- ctor,
- dtor,
-};
-
-#ifdef BUILDING_SO
-SO_PUBLIC const BaseApi* snort_plugins[] =
-{
- &linux_ssl_api.base,
- nullptr
-};
-#else
-const BaseApi* cd_linux_sll = &linux_ssl_api.base;
-#endif
-
+++ /dev/null
-//--------------------------------------------------------------------------
-// Copyright (C) 2014-2016 Cisco and/or its affiliates. All rights reserved.
-//
-// This program is free software; you can redistribute it and/or modify it
-// under the terms of the GNU General Public License Version 2 as published
-// by the Free Software Foundation. You may not use, modify or distribute
-// this program under any other version of the GNU General Public License.
-//
-// This program is distributed in the hope that it will be useful, but
-// WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
-// General Public License for more details.
-//
-// You should have received a copy of the GNU General Public License along
-// with this program; if not, write to the Free Software Foundation, Inc.,
-// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-//--------------------------------------------------------------------------
-// cd_null.cc author Josh Rosenbaum <jrosenba@cisco.com>
-
-#ifdef HAVE_CONFIG_H
-#include "config.h"
-#endif
-
-#include <pcap.h>
-
-#include "framework/codec.h"
-#include "protocols/protocol_ids.h"
-
-#define CD_NULL_NAME "null"
-#define CD_NULL_HELP_STR "support for null encapsulation"
-#define CD_NULL_HELP ADD_DLT(CD_NULL_HELP_STR, DLT_NULL)
-
-namespace
-{
-class NullCodec : public Codec
-{
-public:
- NullCodec() : Codec(CD_NULL_NAME) { }
- ~NullCodec() { }
-
- bool decode(const RawData&, CodecData&, DecodeData&) override;
- void get_data_link_type(std::vector<int>&) override;
-};
-} // namespace
-
-static const uint16_t NULL_HDRLEN = 4;
-
-bool NullCodec::decode(const RawData& raw, CodecData& data, DecodeData&)
-{
- if (raw.len < NULL_HDRLEN)
- return false;
-
- data.lyr_len = NULL_HDRLEN;
- data.next_prot_id = ProtocolId::ETHERTYPE_IPV4;
- return true;
-}
-
-void NullCodec::get_data_link_type(std::vector<int>& v)
-{ v.push_back(DLT_NULL); }
-
-//-------------------------------------------------------------------------
-// api
-//-------------------------------------------------------------------------
-
-static Codec* ctor(Module*)
-{ return new NullCodec(); }
-
-static void dtor(Codec* cd)
-{ delete cd; }
-
-static const CodecApi null_api =
-{
- {
- PT_CODEC,
- sizeof(CodecApi),
- CDAPI_VERSION,
- 0,
- API_RESERVED,
- API_OPTIONS,
- CD_NULL_NAME,
- CD_NULL_HELP,
- nullptr,
- nullptr,
- },
- nullptr, // pinit
- nullptr, // pterm
- nullptr, // tinit
- nullptr, // tterm
- ctor, // ctor
- dtor, // dtor
-};
-
-#ifdef BUILDING_SO
-SO_PUBLIC const BaseApi* snort_plugins[] =
-{
- &null_api.base,
- nullptr
-};
-#else
-const BaseApi* cd_null = &null_api.base;
-#endif
-
+++ /dev/null
-//--------------------------------------------------------------------------
-// Copyright (C) 2014-2016 Cisco and/or its affiliates. All rights reserved.
-// Copyright (C) 2002-2013 Sourcefire, Inc.
-//
-// This program is free software; you can redistribute it and/or modify it
-// under the terms of the GNU General Public License Version 2 as published
-// by the Free Software Foundation. You may not use, modify or distribute
-// this program under any other version of the GNU General Public License.
-//
-// This program is distributed in the hope that it will be useful, but
-// WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
-// General Public License for more details.
-//
-// You should have received a copy of the GNU General Public License along
-// with this program; if not, write to the Free Software Foundation, Inc.,
-// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-//--------------------------------------------------------------------------
-
-#ifdef HAVE_CONFIG_H
-#include "config.h"
-#endif
-
-#include <pcap.h>
-#include "framework/codec.h"
-
-#ifndef DLT_PFLOG
-#define DLT_PFLOG 117
-#endif
-
-#define PFLOG_NAME "pflog"
-#define PFLOG_HELP_STR "support for OpenBSD PF log"
-
-#define PFLOG_HELP ADD_DLT(PFLOG_HELP_STR, DLT_PFLOG)
-
-namespace
-{
-/*
- * Snort supports 3 versions of the OpenBSD pflog header:
- *
- * Pflog1_Hdr: CVS = 1.3, DLT_OLD_PFLOG = 17, Length = 28
- * Pflog2_Hdr: CVS = 1.8, DLT_PFLOG = 117, Length = 48
- * Pflog3_Hdr: CVS = 1.12, DLT_PFLOG = 117, Length = 64
- * Pflog3_Hdr: CVS = 1.172, DLT_PFLOG = 117, Length = 100
- *
- * Since they have the same DLT, Pflog{2,3}Hdr are distinguished
- * by their actual length. The minimum required length excludes
- * padding.
- */
-/* Old OpenBSD pf firewall pflog0 header
- * (information from pf source in kernel)
- * the rule, reason, and action codes tell why the firewall dropped it -fleck
- */
-
-class PflogCodec : public Codec
-{
-public:
- PflogCodec() : Codec(PFLOG_NAME) { }
- ~PflogCodec() { }
-
- bool decode(const RawData&, CodecData&, DecodeData&) override;
- void get_data_link_type(std::vector<int>&) override;
-};
-
-struct Pflog1Hdr
-{
- uint32_t af;
- char intf[IFNAMSIZ];
- int16_t rule;
- uint16_t reason;
- uint16_t action;
- uint16_t dir;
-};
-
-#define PFLOG1_HDRLEN (sizeof(struct _Pflog1_hdr))
-
-/*
- * Note that on OpenBSD, af type is sa_family_t. On Linux, that's an unsigned
- * short, but on OpenBSD, that's a uint8_t, so we should explicitly use uint8_t
- * here. - ronaldo
- */
-
-#define PFLOG_RULELEN 16
-#define PFLOG_PADLEN 3
-
-struct Pflog2Hdr
-{
- int8_t length;
- uint8_t af;
- uint8_t action;
- uint8_t reason;
- char ifname[IFNAMSIZ];
- char ruleset[PFLOG_RULELEN];
- uint32_t rulenr;
- uint32_t subrulenr;
- uint8_t dir;
- uint8_t pad[PFLOG_PADLEN];
-};
-
-#define PFLOG2_HDRLEN (sizeof(Pflog2Hdr))
-#define PFLOG2_HDRMIN (PFLOG2_HDRLEN - PFLOG_PADLEN)
-
-struct Pflog3Hdr
-{
- int8_t length;
- uint8_t af;
- uint8_t action;
- uint8_t reason;
- char ifname[IFNAMSIZ];
- char ruleset[PFLOG_RULELEN];
- uint32_t rulenr;
- uint32_t subrulenr;
- uint32_t uid;
- uint32_t pid;
- uint32_t rule_uid;
- uint32_t rule_pid;
- uint8_t dir;
- uint8_t pad[PFLOG_PADLEN];
-};
-
-#define PFLOG3_HDRLEN (sizeof(Pflog3Hdr))
-#define PFLOG3_HDRMIN (PFLOG3_HDRLEN - PFLOG_PADLEN)
-
-struct Pflog4Hdr
-{
- uint8_t length;
- uint8_t af;
- uint8_t action;
- uint8_t reason;
- char ifname[IFNAMSIZ];
- char ruleset[PFLOG_RULELEN];
- uint32_t rulenr;
- uint32_t subrulenr;
- uint32_t uid;
- uint32_t pid;
- uint32_t rule_uid;
- uint32_t rule_pid;
- uint8_t dir;
- uint8_t rewritten;
- uint8_t pad[2];
- uint8_t saddr[16];
- uint8_t daddr[16];
- uint16_t sport;
- uint16_t dport;
-};
-
-#define PFLOG4_HDRLEN sizeof(struct Pflog4Hdr)
-#define PFLOG4_HDRMIN sizeof(struct Pflog4Hdr)
-} // namespace
-
-void PflogCodec::get_data_link_type(std::vector<int>& v)
-{ v.push_back(DLT_PFLOG); }
-
-bool PflogCodec::decode(const RawData& raw, CodecData& codec, DecodeData&)
-{
- const uint32_t cap_len = raw.len;
- uint8_t af, pflen;
- uint32_t hlen;
- uint32_t padlen = PFLOG_PADLEN;
-
- if (cap_len < PFLOG2_HDRMIN)
- return false;
-
- /* lay the pf header structure over the packet data */
- switch (*((uint8_t*)raw.data))
- {
- case PFLOG2_HDRMIN:
- {
- const Pflog2Hdr* const pf2h =
- reinterpret_cast<const Pflog2Hdr*>(raw.data);
- pflen = pf2h->length;
- hlen = PFLOG2_HDRLEN;
- af = pf2h->af;
- break;
- }
- case PFLOG3_HDRMIN:
- {
- const Pflog3Hdr* const pf3h =
- reinterpret_cast<const Pflog3Hdr*>(raw.data);
- pflen = pf3h->length;
- hlen = PFLOG3_HDRLEN;
- af = pf3h->af;
- break;
- }
- case PFLOG4_HDRMIN:
- {
- const Pflog4Hdr* const pf4h =
- reinterpret_cast<const Pflog4Hdr*>(raw.data);
- pflen = pf4h->length;
- hlen = PFLOG4_HDRLEN;
- af = pf4h->af;
- padlen = sizeof(pf4h->pad);
- break;
- }
- default:
- return false;
- }
-
- /* now that we know a little more, do a little more validation */
- if (cap_len < hlen)
- return false;
-
- /* note that the pflen may exclude the padding which is always present */
- if (pflen < hlen - padlen || pflen > hlen)
- return false;
-
- /* check the network type - should only be AF_INET or AF_INET6 */
- switch (af)
- {
- case AF_INET: /* IPv4 */
- codec.next_prot_id = ProtocolId::ETHERTYPE_IPV4;
- break;
-
-#if defined(AF_INET6)
- case AF_INET6: /* IPv6 */
- codec.next_prot_id = ProtocolId::ETHERTYPE_IPV6;
- break;
-#endif
-
- default:
- /* FIXIT-L add decoder drop event for unknown pflog network type
- * To my knowledge, pflog devices can only
- * pass IP and IP6 packets. -fleck
- */
- break;
- }
-
- codec.lyr_len = hlen;
- return true;
-}
-
-//-------------------------------------------------------------------------
-// api
-//-------------------------------------------------------------------------
-
-static Codec* ctor(Module*)
-{ return new PflogCodec(); }
-
-static void dtor(Codec* cd)
-{ delete cd; }
-
-static const CodecApi pflog_api =
-{
- {
- PT_CODEC,
- sizeof(CodecApi),
- CDAPI_VERSION,
- 0,
- API_RESERVED,
- API_OPTIONS,
- PFLOG_NAME,
- PFLOG_HELP,
- nullptr, // mod_ctor
- nullptr // mod_dtor
- },
- nullptr, // ginit
- nullptr, // gterm
- nullptr, // tinit
- nullptr, // tterm
- ctor,
- dtor,
-};
-
-#ifdef BUILDING_SO
-SO_PUBLIC const BaseApi* snort_plugins[] =
-{
- &pflog_api.base,
- nullptr
-};
-#else
-const BaseApi* cd_pflog = &pflog_api.base;
-#endif
-
+++ /dev/null
-//--------------------------------------------------------------------------
-// Copyright (C) 2014-2016 Cisco and/or its affiliates. All rights reserved.
-// Copyright (C) 2002-2013 Sourcefire, Inc.
-// Copyright (C) 1998-2002 Martin Roesch <roesch@sourcefire.com>
-//
-// This program is free software; you can redistribute it and/or modify it
-// under the terms of the GNU General Public License Version 2 as published
-// by the Free Software Foundation. You may not use, modify or distribute
-// this program under any other version of the GNU General Public License.
-//
-// This program is distributed in the hope that it will be useful, but
-// WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
-// General Public License for more details.
-//
-// You should have received a copy of the GNU General Public License along
-// with this program; if not, write to the Free Software Foundation, Inc.,
-// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-//--------------------------------------------------------------------------
-
-// cd_pim.cc author Josh Rosenbaum <jrosenba@cisco.com>
-
-#ifdef HAVE_CONFIG_H
-#include "config.h"
-#endif
-
-#include "framework/codec.h"
-#include "framework/decode_data.h"
-#include "codecs/codec_module.h"
-
-namespace
-{
-// yes, macros are necessary. The API and class constructor require different strings.
-#define CD_PIM_NAME "pim"
-#define CD_PIM_HELP "support for protocol independent multicast"
-
-class PimCodec : public Codec
-{
-public:
- PimCodec() : Codec(CD_PIM_NAME) { }
- ~PimCodec() { }
-
- void get_protocol_ids(std::vector<ProtocolId>&) override;
- bool decode(const RawData&, CodecData&, DecodeData&) override;
-};
-
-const uint16_t IPPROTO_ID_PIM = 103;
-} // namespace
-
-void PimCodec::get_protocol_ids(std::vector<ProtocolId>& v)
-{
- v.push_back(static_cast<ProtocolId>(IPPROTO_ID_PIM));
-}
-
-bool PimCodec::decode(const RawData&, CodecData& codec, DecodeData&)
-{
- codec_event(codec, DECODE_IP_BAD_PROTO);
- return true;
-}
-
-//-------------------------------------------------------------------------
-// api
-//-------------------------------------------------------------------------
-
-static Codec* ctor(Module*)
-{ return new PimCodec(); }
-
-static void dtor(Codec* cd)
-{ delete cd; }
-
-static const CodecApi pim_api =
-{
- {
- PT_CODEC,
- sizeof(CodecApi),
- CDAPI_VERSION,
- 0,
- API_RESERVED,
- API_OPTIONS,
- CD_PIM_NAME,
- CD_PIM_HELP,
- nullptr,
- nullptr
- },
- nullptr, // pinit
- nullptr, // pterm
- nullptr, // tinit
- nullptr, // tterm
- ctor,
- dtor,
-};
-
-SO_PUBLIC const BaseApi* snort_plugins[] =
-{
- &pim_api.base,
- nullptr
-};
-
+++ /dev/null
-//--------------------------------------------------------------------------
-// Copyright (C) 2014-2016 Cisco and/or its affiliates. All rights reserved.
-//
-// This program is free software; you can redistribute it and/or modify it
-// under the terms of the GNU General Public License Version 2 as published
-// by the Free Software Foundation. You may not use, modify or distribute
-// this program under any other version of the GNU General Public License.
-//
-// This program is distributed in the hope that it will be useful, but
-// WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
-// General Public License for more details.
-//
-// You should have received a copy of the GNU General Public License along
-// with this program; if not, write to the Free Software Foundation, Inc.,
-// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-//--------------------------------------------------------------------------
-// cd_ppp.cc author Josh Rosenbaum <jrosenba@cisco.com>
-
-#ifdef HAVE_CONFIG_H
-#include "config.h"
-#endif
-
-#include <cstdint>
-#include "framework/codec.h"
-
-#define PPP_NAME "ppp"
-#define PPP_HELP_STR "support for point-to-point encapsulation"
-#define PPP_HELP ADD_DLT(PPP_HELP_STR, DLT_PPP)
-
-namespace
-{
-class PPPCodec : public Codec
-{
-public:
- PPPCodec() : Codec(PPP_NAME) { }
- ~PPPCodec() { }
-
- bool decode(const RawData&, CodecData&, DecodeData&) override;
- void get_data_link_type(std::vector<int>&) override;
-};
-} // namespace
-
-#ifndef DLT_PPP
-static constexpr int DLT_PPP = 9;
-#endif
-
-static constexpr uint8_t CHDLC_ADDR_BROADCAST = 0xff;
-static constexpr uint8_t CHDLC_CTRL_UNNUMBERED = 0x03;
-
-void PPPCodec::get_data_link_type(std::vector<int>& v)
-{ v.push_back(DLT_PPP); }
-
-bool PPPCodec::decode(const RawData& raw, CodecData& codec, DecodeData&)
-{
- if (raw.len < 2)
- return false;
-
- if (raw.data[0] == CHDLC_ADDR_BROADCAST && raw.data[1] == CHDLC_CTRL_UNNUMBERED)
- {
- /*
- * Check for full HDLC header (rfc1662 section 3.2)
- */
- codec.lyr_len = 2;
- }
-
- codec.next_prot_id = ProtocolId::ETHERTYPE_PPP;
- return true;
-}
-
-//-------------------------------------------------------------------------
-// api
-//-------------------------------------------------------------------------
-
-static Codec* ctor(Module*)
-{ return new PPPCodec(); }
-
-static void dtor(Codec* cd)
-{ delete cd; }
-
-static const CodecApi ppp_api =
-{
- {
- PT_CODEC,
- sizeof(CodecApi),
- CDAPI_VERSION,
- 0,
- API_RESERVED,
- API_OPTIONS,
- PPP_NAME,
- PPP_HELP,
- nullptr, // mod_ctor
- nullptr, // mod_dtor
- },
- nullptr, // pinit
- nullptr, // pterm
- nullptr, // tinit
- nullptr, // tterm
- ctor,
- dtor,
-};
-
-#ifdef BUILDING_SO
-SO_PUBLIC const BaseApi* snort_plugins[] =
-{
- &ppp_api.base,
- nullptr
-};
-#else
-const BaseApi* cd_ppp = &ppp_api.base;
-#endif
-
+++ /dev/null
-//--------------------------------------------------------------------------
-// Copyright (C) 2014-2016 Cisco and/or its affiliates. All rights reserved.
-//
-// This program is free software; you can redistribute it and/or modify it
-// under the terms of the GNU General Public License Version 2 as published
-// by the Free Software Foundation. You may not use, modify or distribute
-// this program under any other version of the GNU General Public License.
-//
-// This program is distributed in the hope that it will be useful, but
-// WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
-// General Public License for more details.
-//
-// You should have received a copy of the GNU General Public License along
-// with this program; if not, write to the Free Software Foundation, Inc.,
-// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-//--------------------------------------------------------------------------
-// cd_raw4.cc author Josh Rosenbaum <jrosenba@cisco.com>
-
-#ifdef HAVE_CONFIG_H
-#include "config.h"
-#endif
-
-#include <pcap.h>
-
-#include "framework/codec.h"
-#include "protocols/protocol_ids.h"
-
-#define CD_RAW4_NAME "raw4"
-#define CD_RAW4_HELP_STR "support for unencapsulated IPv4"
-#define CD_RAW4_HELP ADD_DLT(ADD_DLT(CD_RAW4_HELP_STR, DLT_RAW), DLT_IPV4)
-
-namespace
-{
-class Raw4Codec : public Codec
-{
-public:
- Raw4Codec() : Codec(CD_RAW4_NAME) { }
- ~Raw4Codec() { }
-
- bool decode(const RawData&, CodecData&, DecodeData&) override;
- void get_data_link_type(std::vector<int>&) override;
-};
-} // namespace
-
-bool Raw4Codec::decode(const RawData&, CodecData& data, DecodeData&)
-{
- data.next_prot_id = ProtocolId::ETHERTYPE_IPV4;
- return true;
-}
-
-void Raw4Codec::get_data_link_type(std::vector<int>& v)
-{
- v.push_back(DLT_RAW);
- v.push_back(DLT_IPV4);
-}
-
-//-------------------------------------------------------------------------
-// api
-//-------------------------------------------------------------------------
-
-static Codec* ctor(Module*)
-{ return new Raw4Codec(); }
-
-static void dtor(Codec* cd)
-{ delete cd; }
-
-static const CodecApi raw4_api =
-{
- {
- PT_CODEC,
- sizeof(CodecApi),
- CDAPI_VERSION,
- 0,
- API_RESERVED,
- API_OPTIONS,
- CD_RAW4_NAME,
- CD_RAW4_HELP,
- nullptr,
- nullptr,
- },
- nullptr, // pinit
- nullptr, // pterm
- nullptr, // tinit
- nullptr, // tterm
- ctor, // ctor
- dtor, // dtor
-};
-
-#ifdef BUILDING_SO
-SO_PUBLIC const BaseApi* snort_plugins[] =
-{
- &raw4_api.base,
- nullptr
-};
-#else
-const BaseApi* cd_raw4 = &raw4_api.base;
-#endif
-
+++ /dev/null
-//--------------------------------------------------------------------------
-// Copyright (C) 2014-2016 Cisco and/or its affiliates. All rights reserved.
-//
-// This program is free software; you can redistribute it and/or modify it
-// under the terms of the GNU General Public License Version 2 as published
-// by the Free Software Foundation. You may not use, modify or distribute
-// this program under any other version of the GNU General Public License.
-//
-// This program is distributed in the hope that it will be useful, but
-// WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
-// General Public License for more details.
-//
-// You should have received a copy of the GNU General Public License along
-// with this program; if not, write to the Free Software Foundation, Inc.,
-// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-//--------------------------------------------------------------------------
-// cd_raw6.cc author Josh Rosenbaum <jrosenba@cisco.com>
-
-#ifdef HAVE_CONFIG_H
-#include "config.h"
-#endif
-
-#include <pcap.h>
-
-#include "framework/codec.h"
-#include "protocols/protocol_ids.h"
-
-#define CD_RAW6_NAME "raw6"
-#define CD_RAW6_HELP_STR "support for unencapsulated IPv6"
-#define CD_RAW6_HELP ADD_DLT(CD_RAW6_HELP_STR, DLT_IPV6)
-
-namespace
-{
-class Raw6Codec : public Codec
-{
-public:
- Raw6Codec() : Codec(CD_RAW6_NAME) { }
- ~Raw6Codec() { }
-
- bool decode(const RawData&, CodecData&, DecodeData&) override;
- void get_data_link_type(std::vector<int>&) override;
-};
-} // namespace
-
-bool Raw6Codec::decode(const RawData&, CodecData& data, DecodeData&)
-{
- data.next_prot_id = ProtocolId::ETHERTYPE_IPV6;
- return true;
-}
-
-void Raw6Codec::get_data_link_type(std::vector<int>& v)
-{ v.push_back(DLT_IPV6); }
-
-//-------------------------------------------------------------------------
-// api
-//-------------------------------------------------------------------------
-
-static Codec* ctor(Module*)
-{ return new Raw6Codec(); }
-
-static void dtor(Codec* cd)
-{ delete cd; }
-
-static const CodecApi raw6_api =
-{
- {
- PT_CODEC,
- sizeof(CodecApi),
- CDAPI_VERSION,
- 0,
- API_RESERVED,
- API_OPTIONS,
- CD_RAW6_NAME,
- CD_RAW6_HELP,
- nullptr,
- nullptr,
- },
- nullptr, // pinit
- nullptr, // pterm
- nullptr, // tinit
- nullptr, // tterm
- ctor, // ctor
- dtor, // dtor
-};
-
-#ifdef BUILDING_SO
-SO_PUBLIC const BaseApi* snort_plugins[] =
-{
- &raw6_api.base,
- nullptr
-};
-#else
-const BaseApi* cd_raw6 = &raw6_api.base;
-#endif
-
+++ /dev/null
-//--------------------------------------------------------------------------
-// Copyright (C) 2014-2016 Cisco and/or its affiliates. All rights reserved.
-//
-// This program is free software; you can redistribute it and/or modify it
-// under the terms of the GNU General Public License Version 2 as published
-// by the Free Software Foundation. You may not use, modify or distribute
-// this program under any other version of the GNU General Public License.
-//
-// This program is distributed in the hope that it will be useful, but
-// WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
-// General Public License for more details.
-//
-// You should have received a copy of the GNU General Public License along
-// with this program; if not, write to the Free Software Foundation, Inc.,
-// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-//--------------------------------------------------------------------------
-// cd_sip.cc author Josh Rosenbaum <jrosenba@cisco.com>
-
-#include <pcap.h>
-#include <cstdint>
-#include "framework/codec.h"
-#include "protocols/protocol_ids.h"
-
-#define CD_SLIP_NAME "slip"
-#define CD_SLIP_HELP_STR "support for slip protocol"
-#define CD_SLIP_HELP ADD_DLT(CD_SLIP_HELP_STR, DLT_SLIP)
-
-const uint16_t SLIP_HEADER_LEN = 16;
-
-namespace
-{
-class SlipCodec : public Codec
-{
-public:
- SlipCodec() : Codec(CD_SLIP_NAME) { }
- ~SlipCodec() { }
-
- bool decode(const RawData&, CodecData&, DecodeData&) override;
- void get_data_link_type(std::vector<int>&) override;
-};
-} // namespace
-
-void SlipCodec::get_data_link_type(std::vector<int>& v)
-{
-#if DLT_SLIP
- v.push_back(DLT_SLIP);
-#endif
-}
-
-bool SlipCodec::decode(const RawData& raw, CodecData& codec, DecodeData&)
-{
- if (raw.len < SLIP_HEADER_LEN)
- return false;
-
- // set the fields which will be sent back to the packet manager
- codec.lyr_len = SLIP_HEADER_LEN;
- codec.next_prot_id = ProtocolId::ETHERTYPE_IPV4;
- return true;
-}
-
-//-------------------------------------------------------------------------
-// api
-//-------------------------------------------------------------------------
-
-static Codec* ctor(Module*)
-{ return new SlipCodec(); }
-
-static void dtor(Codec* cd)
-{ delete cd; }
-
-static const CodecApi slip_api =
-{
- {
- PT_CODEC,
- sizeof(CodecApi),
- CDAPI_VERSION,
- 0,
- API_RESERVED,
- API_OPTIONS,
- CD_SLIP_NAME,
- CD_SLIP_HELP,
- nullptr,
- nullptr
- },
- nullptr,
- nullptr,
- nullptr,
- nullptr,
- ctor,
- dtor
-};
-
-#ifdef BUILDING_SO
-SO_PUBLIC const BaseApi* snort_plugins[] =
-{
- &slip_api.base,
- nullptr
-};
-#else
-const BaseApi* cd_slip = &slip_api.base;
-#endif
-
+++ /dev/null
-//--------------------------------------------------------------------------
-// Copyright (C) 2014-2016 Cisco and/or its affiliates. All rights reserved.
-// Copyright (C) 2002-2013 Sourcefire, Inc.
-// Copyright (C) 1998-2002 Martin Roesch <roesch@sourcefire.com>
-//
-// This program is free software; you can redistribute it and/or modify it
-// under the terms of the GNU General Public License Version 2 as published
-// by the Free Software Foundation. You may not use, modify or distribute
-// this program under any other version of the GNU General Public License.
-//
-// This program is distributed in the hope that it will be useful, but
-// WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
-// General Public License for more details.
-//
-// You should have received a copy of the GNU General Public License along
-// with this program; if not, write to the Free Software Foundation, Inc.,
-// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-//--------------------------------------------------------------------------
-// token_ring.h author Josh Rosenbaum <jrosenba@cisco.com>
-
-#ifdef HAVE_CONFIG_H
-#include "config.h"
-#endif
-
-#include <pcap.h>
-#include "protocols/token_ring.h"
-#include "framework/codec.h"
-#include "codecs/codec_module.h"
-
-#ifdef DLT_IEEE802
-
-namespace
-{
-#define TR_NAME "token_ring"
-#define TR_HELP "support for token ring decoding"
-
-static const RuleMap tkr_rules[] =
-{
- { DECODE_BAD_TRH, "(" TR_NAME ") Bad Token Ring Header" },
- { DECODE_BAD_TR_ETHLLC, "(" TR_NAME ") Bad Token Ring ETHLLC Header" },
- { DECODE_BAD_TR_MR_LEN, "(" TR_NAME ") Bad Token Ring MRLENHeader" },
- { DECODE_BAD_TRHMR, "(" TR_NAME ") Bad Token Ring MR Header" },
- { 0, nullptr }
-};
-
-class TrCodecModule : public CodecModule
-{
-public:
- TrCodecModule() : CodecModule(TR_NAME, TR_HELP) { }
-
- const RuleMap* get_rules() const override
- { return tkr_rules; }
-};
-
-class TrCodec : public Codec
-{
-public:
- TrCodec() : Codec(TR_NAME) { }
- ~TrCodec() { }
-
- void get_data_link_type(std::vector<int>&) override;
- bool decode(const RawData&, CodecData&, DecodeData&) override;
-};
-
-// THESE ARE NEVER USED!!
-#define MINIMAL_TOKENRING_HEADER_LEN 22
-#define TR_HLEN MINIMAL_TOKENRING_HEADER_LEN
-#define TOKENRING_LLC_LEN 8
-// DELETE FIN
-
-#define TR_ALEN 6 /* octets in an Ethernet header */
-
-#define AC 0x10
-#define LLC_FRAME 0x40
-
-#define TRMTU 2000 /* 2000 bytes */
-#define TR_RII 0x80
-#define TR_RCF_DIR_BIT 0x80
-#define TR_RCF_LEN_MASK 0x1f00
-#define TR_RCF_BROADCAST 0x8000 /* all-routes broadcast */
-#define TR_RCF_LIMITED_BROADCAST 0xC000 /* single-route broadcast */
-#define TR_RCF_FRAME2K 0x20
-#define TR_RCF_BROADCAST_MASK 0xC000
-} // namespace
-
-void TrCodec::get_data_link_type(std::vector<int>& v)
-{
- v.push_back(DLT_IEEE802);
-}
-
-//void DecodeTRPkt(Packet * p, const DAQ_PktHdr_t * pkthdr, const uint8_t * pkt)
-bool TrCodec::decode(const RawData& raw, CodecData& codec, DecodeData&)
-{
- const uint32_t cap_len = raw.len;
- uint32_t dataoff; /* data offset is variable here */
-
- if (cap_len < sizeof(token_ring::Trh_hdr))
- {
- codec_event(codec, DECODE_BAD_TRH);
- return false;
- }
-
- /* lay the tokenring header structure over the packet data */
- //const token_ring::Trh_hdr *trh = reinterpret_cast<const token_ring::Trh_hdr *>(raw_pkt);
-
- /*
- * according to rfc 1042:
- *
- * The presence of a Routing Information Field is indicated by the Most
- * Significant Bit (MSB) of the source address, called the Routing
- * Information Indicator (RII). If the RII equals zero, a RIF is
- * not present. If the RII equals 1, the RIF is present.
- * ..
- * However the MSB is already zeroed by this moment, so there's no
- * real way to figure out whether RIF is presented in packet, so we are
- * doing some tricks to find IPARP signature..
- */
-
- /*
- * first I assume that we have single-ring network with no RIF
- * information presented in frame
- */
- if (cap_len < (sizeof(token_ring::Trh_hdr) + sizeof(token_ring::Trh_llc)))
- {
- codec_event(codec, DECODE_BAD_TR_ETHLLC);
- return false;
- }
-
- const token_ring::Trh_llc* trhllc =
- reinterpret_cast<const token_ring::Trh_llc*>(raw.data + sizeof(token_ring::Trh_hdr));
-
- if (trhllc->dsap != IPARP_SAP && trhllc->ssap != IPARP_SAP)
- {
- /*
- * DSAP != SSAP != 0xAA .. either we are having frame which doesn't
- * carry IP datagrams or has RIF information present. We assume
- * lattest ...
- */
-
- if (cap_len < (sizeof(token_ring::Trh_hdr) + sizeof(token_ring::Trh_llc) +
- sizeof(token_ring::Trh_mr)))
- {
- codec_event(codec, DECODE_BAD_TRHMR);
- return false;
- }
-
- const token_ring::Trh_mr* const trhmr =
- reinterpret_cast<const token_ring::Trh_mr*>(raw.data + sizeof(token_ring::Trh_hdr));
-
- if (cap_len < (sizeof(token_ring::Trh_hdr) + sizeof(token_ring::Trh_llc) +
- sizeof(token_ring::Trh_mr) + TRH_MR_LEN(trhmr)))
- {
- codec_event(codec, DECODE_BAD_TR_MR_LEN);
- return false;
- }
-
- dataoff = sizeof(token_ring::Trh_hdr) + TRH_MR_LEN(trhmr) + sizeof(token_ring::Trh_llc);
- }
- else
- {
- dataoff = sizeof(token_ring::Trh_hdr) + sizeof(token_ring::Trh_llc);
- }
-
- /*
- * ideally we would need to check both SSAP, DSAP, and protoid fields: IP
- * datagrams and ARP requests and replies are transmitted in standard
- * 802.2 LLC Type 1 Unnumbered Information format, control code 3, with
- * the DSAP and the SSAP fields of the 802.2 header set to 170, the
- * assigned global SAP value for SNAP [6]. The 24-bit Organization Code
- * in the SNAP is zero, and the remaining 16 bits are the EtherType from
- * Assigned Numbers [7] (IP = 2048, ARP = 2054). .. but we would check
- * SSAP and DSAP and assume this would be enough to trust.
- */
- if (trhllc->dsap != IPARP_SAP && trhllc->ssap != IPARP_SAP)
- {
- return false;
- }
-
- codec.lyr_len = dataoff;
- codec.next_prot_id = trhllc->ethertype();
- return true;
-}
-
-//-------------------------------------------------------------------------
-// api
-//-------------------------------------------------------------------------
-
-static Module* mod_ctor()
-{ return new TrCodecModule; }
-
-static void mod_dtor(Module* m)
-{ delete m; }
-
-static Codec* ctor(Module*)
-{ return new TrCodec(); }
-
-static void dtor(Codec* cd)
-{ delete cd; }
-
-static const CodecApi tr_api =
-{
- {
- PT_CODEC,
- sizeof(CodecApi),
- CDAPI_VERSION,
- 0,
- API_RESERVED,
- API_OPTIONS,
- TR_NAME,
- TR_HELP,
- mod_ctor,
- mod_dtor
- },
- nullptr, // pinit
- nullptr, // pterm
- nullptr, // tinit
- nullptr, // tterm
- ctor,
- dtor,
-};
-
-SO_PUBLIC const BaseApi* snort_plugins[] =
-{
- &tr_api.base,
- nullptr
-};
-
-#endif
-
+++ /dev/null
-//--------------------------------------------------------------------------
-// Copyright (C) 2014-2016 Cisco and/or its affiliates. All rights reserved.
-// Copyright (C) 2002-2013 Sourcefire, Inc.
-//
-// This program is free software; you can redistribute it and/or modify it
-// under the terms of the GNU General Public License Version 2 as published
-// by the Free Software Foundation. You may not use, modify or distribute
-// this program under any other version of the GNU General Public License.
-//
-// This program is distributed in the hope that it will be useful, but
-// WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
-// General Public License for more details.
-//
-// You should have received a copy of the GNU General Public License along
-// with this program; if not, write to the Free Software Foundation, Inc.,
-// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-//--------------------------------------------------------------------------
-// cd_wlan.cc author Josh Rosenbaum <jrosenba@cisco.com>
-
-#ifdef HAVE_CONFIG_H
-#include "config.h"
-#endif
-
-#include <pcap.h>
-#include "protocols/wlan.h"
-#include "framework/codec.h"
-#include "codecs/codec_module.h"
-#include "protocols/protocol_ids.h"
-#include "log/text_log.h"
-
-#ifndef DLT_IEEE802_11
-#define DLT_IEEE802_11 105
-#endif
-
-#define CD_WLAN_NAME "wlan"
-#define CD_WLAN_HELP_STR "support for wireless local area network protocol"
-#define CD_WLAN_HELP ADD_DLT(CD_WLAN_HELP_STR, DLT_IEEE802_11)
-
-namespace
-{
-static const RuleMap wlan_rules[] =
-{
- { DECODE_BAD_80211_ETHLLC, "bad 802.11 LLC header" },
- { DECODE_BAD_80211_OTHER, "bad 802.11 extra LLC info" },
- { 0, nullptr }
-};
-
-class WlanCodecModule : public CodecModule
-{
-public:
- WlanCodecModule() : CodecModule(CD_WLAN_NAME, CD_WLAN_HELP) { }
-
- const RuleMap* get_rules() const
- { return wlan_rules; }
-};
-
-class WlanCodec : public Codec
-{
-public:
- WlanCodec() : Codec(CD_WLAN_NAME) { }
- ~WlanCodec() { }
-
- bool decode(const RawData&, CodecData&, DecodeData&) override;
- void get_data_link_type(std::vector<int>&) override;
- void get_protocol_ids(std::vector<ProtocolId>& v) override;
- void log(TextLog* const, const uint8_t* pkt, const uint16_t len) override;
-};
-
-#define MINIMAL_IEEE80211_HEADER_LEN 10 /* Ack frames and others */
-#define IEEE802_11_DATA_HDR_LEN 24 /* Header for data packets */
-} // namespace
-
-void WlanCodec::get_data_link_type(std::vector<int>& v)
-{ v.push_back(DLT_IEEE802_11); }
-
-void WlanCodec::get_protocol_ids(std::vector<ProtocolId>& v)
-{ v.push_back(ProtocolId::ETHERNET_802_11); }
-
-bool WlanCodec::decode(const RawData& raw, CodecData& codec, DecodeData&)
-{
- if (raw.len < MINIMAL_IEEE80211_HEADER_LEN)
- return false;
-
- /* lay the wireless structure over the packet data */
- const wlan::WifiHdr* wifih = reinterpret_cast<const wlan::WifiHdr*>(raw.data);
-
- /* determine frame type */
- switch (wifih->frame_control & 0x00ff)
- {
- /* management frames */
- case WLAN_TYPE_MGMT_ASREQ:
- case WLAN_TYPE_MGMT_ASRES:
- case WLAN_TYPE_MGMT_REREQ:
- case WLAN_TYPE_MGMT_RERES:
- case WLAN_TYPE_MGMT_PRREQ:
- case WLAN_TYPE_MGMT_PRRES:
- case WLAN_TYPE_MGMT_BEACON:
- case WLAN_TYPE_MGMT_ATIM:
- case WLAN_TYPE_MGMT_DIS:
- case WLAN_TYPE_MGMT_AUTH:
- case WLAN_TYPE_MGMT_DEAUTH:
- break;
-
- /* Control frames */
- case WLAN_TYPE_CONT_PS:
- case WLAN_TYPE_CONT_RTS:
- case WLAN_TYPE_CONT_CTS:
- case WLAN_TYPE_CONT_ACK:
- case WLAN_TYPE_CONT_CFE:
- case WLAN_TYPE_CONT_CFACK:
- break;
- /* Data packets without data */
- case WLAN_TYPE_DATA_NULL:
- case WLAN_TYPE_DATA_CFACK:
- case WLAN_TYPE_DATA_CFPL:
- case WLAN_TYPE_DATA_ACKPL:
-
- break;
- case WLAN_TYPE_DATA_DTCFACK:
- case WLAN_TYPE_DATA_DTCFPL:
- case WLAN_TYPE_DATA_DTACKPL:
- case WLAN_TYPE_DATA_DATA:
- {
- codec.lyr_len = IEEE802_11_DATA_HDR_LEN;
- codec.next_prot_id = ProtocolId::ETHERNET_LLC;
-
- break;
- }
- default:
- break;
- }
-
- return true;
-}
-
-void WlanCodec::log(TextLog* const text_log, const uint8_t* raw_pkt,
- const uint16_t /*lyr_len*/)
-{
- const wlan::WifiHdr* wifih = reinterpret_cast<const wlan::WifiHdr*>(raw_pkt);
-
- /* src addr */
- TextLog_Print(text_log, "addr1(%02X:%02X:%02X:%02X:%02X:%02X) -> ",
- wifih->addr1[0], wifih->addr1[1], wifih->addr1[2],
- wifih->addr1[3], wifih->addr1[4], wifih->addr1[5]);
-
- /* dest addr */
- TextLog_Print(text_log, "%02X:%02X:%02X:%02X:%02X:%02X)",
- wifih->addr2[0], wifih->addr2[1], wifih->addr2[2],
- wifih->addr2[3], wifih->addr2[4], wifih->addr2[5]);
-
- TextLog_NewLine(text_log);
- TextLog_Putc(text_log, '\t');
- TextLog_Print(text_log, "frame_control:%02x duration_id:%02x "
- "seq_control:%02x", ntohs(wifih->frame_control),
- ntohs(wifih->duration_id), ntohs(wifih->seq_control));
-}
-
-//-------------------------------------------------------------------------
-// api
-//-------------------------------------------------------------------------
-
-static Module* mod_ctor()
-{ return new WlanCodecModule; }
-
-static void mod_dtor(Module* m)
-{ delete m; }
-
-static Codec* ctor(Module*)
-{ return new WlanCodec(); }
-
-static void dtor(Codec* cd)
-{ delete cd; }
-
-static const CodecApi wlan_api =
-{
- {
- PT_CODEC,
- sizeof(CodecApi),
- CDAPI_VERSION,
- 0,
- API_RESERVED,
- API_OPTIONS,
- CD_WLAN_NAME,
- CD_WLAN_HELP,
- mod_ctor,
- mod_dtor
- },
- nullptr,
- nullptr,
- nullptr,
- nullptr,
- ctor,
- dtor,
-};
-
-#ifdef BUILDING_SO
-SO_PUBLIC const BaseApi* snort_plugins[] =
-{
- &wlan_api.base,
- nullptr
-};
-#else
-const BaseApi* cd_wlan = &wlan_api.base;
-#endif
-
+++ /dev/null
-
-add_example_library(daq_socket daqs daq_socket.c)
-
+++ /dev/null
-
-daqlibdir = $(pkglibdir)/daqs
-
-daqlib_LTLIBRARIES = daq_socket.la
-daq_socket_la_CFLAGS = -DBUILDING_SO
-daq_socket_la_LDFLAGS = -module -export-dynamic -avoid-version -shared
-daq_socket_la_SOURCES = daq_socket.c
-
+++ /dev/null
-/*--------------------------------------------------------------------------
-// Copyright (C) 2015-2016 Cisco and/or its affiliates. All rights reserved.
-//
-// This program is free software; you can redistribute it and/or modify it
-// under the terms of the GNU General Public License Version 2 as published
-// by the Free Software Foundation. You may not use, modify or distribute
-// this program under any other version of the GNU General Public License.
-//
-// This program is distributed in the hope that it will be useful, but
-// WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
-// General Public License for more details.
-//
-// You should have received a copy of the GNU General Public License along
-// with this program; if not, write to the Free Software Foundation, Inc.,
-// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-//--------------------------------------------------------------------------
-*/
-/* daq_socket.c author Russ Combs <rucombs@cisco.com> */
-
-#include "daqs/daq_user.h"
-
-#ifdef HAVE_CONFIG_H
-#include "config.h"
-#endif
-
-#include <errno.h>
-#include <stdlib.h>
-#include <string.h>
-#include <stdio.h>
-
-#include <sys/types.h>
-#include <sys/time.h>
-#include <sys/unistd.h>
-
-#include <netinet/in.h>
-#include <sys/socket.h>
-#include <netinet/in_systm.h>
-#include <netinet/ip.h>
-
-#include <daq_api.h>
-#include <sfbpf_dlt.h>
-
-#define DAQ_MOD_VERSION 0
-#define DAQ_NAME "socket"
-#define DAQ_TYPE (DAQ_TYPE_INTF_CAPABLE | DAQ_TYPE_INLINE_CAPABLE | DAQ_TYPE_MULTI_INSTANCE)
-#define DEFAULT_PORT 8000
-
-typedef struct {
- int sock_a; // recv from b
- int sock_b; // recv from a
- int sock_c; // connect
-
- int use_a;
- int port;
- int passive;
- int stop;
-
- unsigned timeout;
- unsigned snaplen;
-
- struct sockaddr_in sin_a;
- struct sockaddr_in sin_b;
-
- DAQ_UsrHdr_t pci;
-
- uint8_t* buf;
- char error[DAQ_ERRBUF_SIZE];
-
- DAQ_State state;
- DAQ_Stats_t stats;
-} SockImpl;
-
-//-------------------------------------------------------------------------
-// socket functions
-//-------------------------------------------------------------------------
-
-static int sock_setup(SockImpl* impl)
-{
- struct sockaddr_in sin;
-
- if ( (impl->sock_c = socket(PF_INET, SOCK_STREAM, 0)) == -1 )
- {
- DPE(impl->error, "%s: can't create listener socket (%s)\n", __func__, strerror(errno));
- return -1;
- }
-
- sin.sin_family = PF_INET;
- sin.sin_addr.s_addr = INADDR_ANY;
- sin.sin_port = htons(impl->port);
-
- if ( bind(impl->sock_c, (struct sockaddr*)&sin, sizeof(sin)) == -1 )
- {
- DPE(impl->error, "%s: can't bind listener socket (%s)\n", __func__, strerror(errno));
- return -1;
- }
-
- if ( listen(impl->sock_c, 2) == -1 )
- {
- DPE(impl->error, "%s: can't listen on socket (%s)\n", __func__, strerror(errno));
- return -1;
- }
- return 0;
-}
-
-static void sock_cleanup(SockImpl* impl)
-{
- if ( impl->sock_c >= 0 )
- close(impl->sock_c);
-
- if ( impl->sock_a >= 0 )
- close(impl->sock_a);
-
- if ( impl->sock_b >= 0 )
- close(impl->sock_b);
-
- impl->sock_c = impl->sock_a = impl->sock_b = -1;
-}
-
-static int sock_recv(SockImpl* impl, int* sock)
-{
- int n = recv(*sock, impl->buf, impl->snaplen, 0);
-
- if ( n <= 0 )
- {
- if (errno != EINTR)
- {
- DPE(impl->error, "%s: can't recv from socket (%s)\n", __func__, strerror(errno));
- impl->pci.flags = DAQ_USR_FLAG_END_FLOW;
- *sock = -1;
- }
- return 0;
- }
- return n;
-}
-
-static int sock_send(
- SockImpl* impl, int sock, const uint8_t* buf, uint32_t len)
-{
- if ( sock < 0 )
- return 0;
-
- int n = send(sock, buf, len, 0);
-
- while ( 0 <= n && (uint32_t)n < len )
- {
- buf += n;
- len -= n;
- n = send(sock, buf, len, 0);
- }
- if ( n == -1 )
- {
- DPE(impl->error, "%s: can't send on socket (%s)\n", __func__, strerror(errno));
- return -1;
- }
- return 0;
-}
-
-static int sock_accept(SockImpl* impl, int* sock, struct sockaddr_in* psin)
-{
- const char* banner;
- socklen_t len = sizeof(*psin);
- *sock = accept(impl->sock_c, (struct sockaddr*)psin, &len);
-
- if ( *sock == -1 )
- {
- DPE(impl->error, "%s: can't accept incoming connection (%s)\n", __func__, strerror(errno));
- return -1;
- }
- banner = impl->use_a ? "client\n" : "server\n";
- sock_send(impl, *sock, (const uint8_t*)banner, 7);
-
- impl->pci.flags = DAQ_USR_FLAG_START_FLOW;
- return 0;
-}
-
-static int sock_poll(SockImpl* impl, int* sock, struct sockaddr_in* psin)
-{
- int max_fd;
- fd_set inputs;
-
- if ( impl->sock_c < 0 )
- return 0;
-
- FD_ZERO(&inputs);
- FD_SET(impl->sock_c, &inputs);
- max_fd = impl->sock_c;
-
- if ( *sock > 0 )
- {
- FD_SET(*sock, &inputs);
-
- if ( *sock > max_fd )
- max_fd = *sock;
- }
-
- struct timeval timeout;
- timeout.tv_sec = 1;
- timeout.tv_usec = 0;
-
- if ( !select(max_fd+1, &inputs, NULL, NULL, &timeout) )
- return 0;
-
- else if ( *sock >= 0 && FD_ISSET(*sock, &inputs) )
- return sock_recv(impl, sock);
-
- else if ( *sock < 0 && FD_ISSET(impl->sock_c, &inputs) )
- return sock_accept(impl, sock, psin);
-
- return 0;
-}
-
-//-------------------------------------------------------------------------
-// daq utilities
-//-------------------------------------------------------------------------
-
-static void clear(SockImpl* impl)
-{
- if ( impl->sock_a < 0 )
- {
- impl->sin_a.sin_addr.s_addr = 0;
- impl->sin_a.sin_port = 0;
- }
- if ( impl->sock_b < 0 )
- {
- impl->sin_b.sin_addr.s_addr = 0;
- impl->sin_b.sin_port = 0;
- }
-}
-
-static void set_pkt_hdr(SockImpl* impl, DAQ_PktHdr_t* phdr, ssize_t len)
-{
- struct timeval t;
- gettimeofday(&t, NULL);
-
- phdr->ts.tv_sec = t.tv_sec;
- phdr->ts.tv_usec = t.tv_usec;
- phdr->caplen = len;
- phdr->pktlen = len;
- phdr->ingress_index = -1;
- phdr->egress_index = -1;
- phdr->ingress_group = -1;
- phdr->egress_group = -1;
- phdr->flags = 0;
- phdr->address_space_id = 0;
- phdr->opaque = 0;
-
- // use_a already toggled
- if ( impl->use_a )
- {
- impl->pci.src_addr = impl->sin_b.sin_addr.s_addr;
- impl->pci.dst_addr = impl->sin_a.sin_addr.s_addr;
- impl->pci.src_port = impl->sin_b.sin_port;
- impl->pci.dst_port = impl->sin_a.sin_port;
- impl->pci.flags &= ~DAQ_USR_FLAG_TO_SERVER;
- }
- else
- {
- impl->pci.src_addr = impl->sin_a.sin_addr.s_addr;
- impl->pci.dst_addr = impl->sin_b.sin_addr.s_addr;
- impl->pci.src_port = impl->sin_a.sin_port;
- impl->pci.dst_port = impl->sin_b.sin_port;
- impl->pci.flags |= DAQ_USR_FLAG_TO_SERVER;
- }
-
- if ( impl->pci.flags & DAQ_USR_FLAG_END_FLOW )
- clear(impl);
-
- phdr->priv_ptr = &impl->pci;
-}
-
-// forward all but drops, retries and blacklists:
-static const int s_fwd[MAX_DAQ_VERDICT] = { 1, 0, 1, 1, 0, 1, 0 };
-
-static int socket_daq_process(
- SockImpl* impl, DAQ_Analysis_Func_t cb, void* user)
-{
- DAQ_PktHdr_t hdr;
- int* sock = impl->use_a ? &impl->sock_a : &impl->sock_b;
- struct sockaddr_in* psin = impl->use_a ? &impl->sin_a : &impl->sin_b;
- impl->pci.flags = 0;
-
- int n = sock_poll(impl, sock, psin);
-
- // don't toggle w/o at least one connection so client is always 1st
- if ( impl->sock_a > -1 || impl->sock_b > -1 )
- impl->use_a = !impl->use_a;
-
- if ( n <= 0 && !impl->pci.flags )
- return n;
-
- set_pkt_hdr(impl, &hdr, n);
- DAQ_Verdict verdict = cb(user, &hdr, impl->buf);
-
- if ( verdict >= MAX_DAQ_VERDICT )
- verdict = DAQ_VERDICT_BLOCK;
-
- impl->stats.verdicts[verdict]++;
-
- if ( impl->passive || s_fwd[verdict] )
- {
- // already toggled use_a, so we get a->b or b->a
- sock = impl->use_a ? &impl->sock_a : &impl->sock_b;
- sock_send(impl, *sock, impl->buf, n);
- }
- return n;
-}
-
-static int socket_daq_config (
- SockImpl* impl, const DAQ_Config_t* cfg, char* errBuf, size_t errMax)
-{
- DAQ_Dict* entry;
-
- if ( cfg->name )
- {
- char* end = NULL;
- impl->port = (int)strtol(cfg->name, &end, 0);
- }
- for ( entry = cfg->values; entry; entry = entry->next)
- {
- if ( !entry->value || !*entry->value )
- {
- snprintf(errBuf, errMax, "%s: variable needs value (%s)\n", __func__, entry->key);
- return DAQ_ERROR;
- }
- else if ( !strcmp(entry->key, "port") )
- {
- char* end = entry->value;
- impl->port = (int)strtol(entry->value, &end, 0);
-
- if ( *end || impl->port <= 0 || impl->port > 65535 )
- {
- snprintf(errBuf, errMax, "%s: bad port (%s)\n", __func__, entry->value);
- return DAQ_ERROR;
- }
- }
- else if ( !strcmp(entry->key, "proto") )
- {
- if ( !strcmp(entry->value, "tcp") )
- impl->pci.ip_proto = IPPROTO_TCP;
-
- else if ( !strcmp(entry->value, "udp") )
- impl->pci.ip_proto = IPPROTO_UDP;
- else
- {
- snprintf(errBuf, errMax, "%s: bad proto (%s)\n", __func__, entry->value);
- return DAQ_ERROR;
- }
- }
- else
- {
- snprintf(errBuf, errMax,
- "%s: unsupported variable (%s=%s)\n", __func__, entry->key, entry->value);
- return DAQ_ERROR;
- }
- }
- if ( !impl->pci.ip_proto )
- impl->pci.ip_proto = IPPROTO_TCP;
-
- if ( !impl->port )
- impl->port = DEFAULT_PORT;
-
- impl->snaplen = cfg->snaplen ? cfg->snaplen : IP_MAXPACKET;
- impl->timeout = cfg->timeout;
- impl->passive = ( cfg->mode == DAQ_MODE_PASSIVE );
-
- return DAQ_SUCCESS;
-}
-
-//-------------------------------------------------------------------------
-// daq
-//-------------------------------------------------------------------------
-
-static void socket_daq_shutdown (void* handle)
-{
- SockImpl* impl = (SockImpl*)handle;
-
- if ( impl->buf )
- free(impl->buf);
-
- free(impl);
-}
-
-//-------------------------------------------------------------------------
-
-static int socket_daq_initialize (
- const DAQ_Config_t* cfg, void** handle, char* errBuf, size_t errMax)
-{
- SockImpl* impl = calloc(1, sizeof(*impl));
-
- if ( !impl )
- {
- snprintf(errBuf, errMax, "%s: failed to allocate the ipfw context!", __func__);
- return DAQ_ERROR_NOMEM;
- }
-
- if ( socket_daq_config(impl, cfg, errBuf, errMax) != DAQ_SUCCESS )
- {
- socket_daq_shutdown(impl);
- return DAQ_ERROR;
- }
- impl->buf = malloc(impl->snaplen);
-
- if ( !impl->buf )
- {
- snprintf(errBuf, errMax, "%s: failed to allocate the ipfw buffer!", __func__);
- socket_daq_shutdown(impl);
- return DAQ_ERROR_NOMEM;
- }
-
- impl->sock_c = impl->sock_a = impl->sock_b = -1;
- impl->use_a = 1;
- impl->state = DAQ_STATE_INITIALIZED;
-
- *handle = impl;
- return DAQ_SUCCESS;
-}
-
-//-------------------------------------------------------------------------
-
-static int socket_daq_start (void* handle)
-{
- SockImpl* impl = (SockImpl*)handle;
-
- if ( sock_setup(impl) )
- return DAQ_ERROR;
-
- impl->state = DAQ_STATE_STARTED;
- return DAQ_SUCCESS;
-}
-
-static int socket_daq_stop (void* handle)
-{
- SockImpl* impl = (SockImpl*)handle;
- sock_cleanup(impl);
- impl->state = DAQ_STATE_STOPPED;
- return DAQ_SUCCESS;
-}
-
-//-------------------------------------------------------------------------
-
-static int socket_daq_inject (
- void* handle, const DAQ_PktHdr_t* hdr, const uint8_t* buf, uint32_t len,
- int reverse)
-{
- (void)hdr;
-
- SockImpl* impl = (SockImpl*)handle;
- int sock;
-
- if ( reverse )
- sock = impl->use_a ? impl->sock_b : impl->sock_a;
- else
- sock = impl->use_a ? impl->sock_a : impl->sock_b;
-
- int status = sock_send(impl, sock, buf, len);
-
- if ( status )
- return DAQ_ERROR;
-
- impl->stats.packets_injected++;
- return DAQ_SUCCESS;
-}
-
-//-------------------------------------------------------------------------
-
-static int socket_daq_acquire (
- void* handle, int cnt, DAQ_Analysis_Func_t callback, DAQ_Meta_Func_t meta, void* user)
-{
- (void)meta;
-
- SockImpl* impl = (SockImpl*)handle;
- int hit = 0, miss = 0;
- impl->stop = 0;
-
- while ( hit < cnt || cnt <= 0 )
- {
- int status = socket_daq_process(impl, callback, user);
-
- if ( status > 0 )
- {
- hit++;
- miss = 0;
- }
- else if ( status < 0 )
- return DAQ_ERROR;
-
- else if ( ++miss == 2 || impl->stop )
- break;
- }
- return DAQ_SUCCESS;
-}
-
-//-------------------------------------------------------------------------
-
-static int socket_daq_breakloop (void* handle)
-{
- SockImpl* impl = (SockImpl*)handle;
- impl->stop = 1;
- return DAQ_SUCCESS;
-}
-
-static DAQ_State socket_daq_check_status (void* handle)
-{
- SockImpl* impl = (SockImpl*)handle;
- return impl->state;
-}
-
-static int socket_daq_get_stats (void* handle, DAQ_Stats_t* stats)
-{
- SockImpl* impl = (SockImpl*)handle;
- *stats = impl->stats;
- return DAQ_SUCCESS;
-}
-
-static void socket_daq_reset_stats (void* handle)
-{
- SockImpl* impl = (SockImpl*)handle;
- memset(&impl->stats, 0, sizeof(impl->stats));
-}
-
-static int socket_daq_get_snaplen (void* handle)
-{
- SockImpl* impl = (SockImpl*)handle;
- return impl->snaplen;
-}
-
-static uint32_t socket_daq_get_capabilities (void* handle)
-{
- (void)handle;
- return DAQ_CAPA_BLOCK | DAQ_CAPA_REPLACE | DAQ_CAPA_INJECT | DAQ_CAPA_INJECT_RAW
- | DAQ_CAPA_BREAKLOOP | DAQ_CAPA_UNPRIV_START;
-}
-
-static int socket_daq_get_datalink_type(void *handle)
-{
- (void)handle;
- return DLT_USER;
-}
-
-static const char* socket_daq_get_errbuf (void* handle)
-{
- SockImpl* impl = (SockImpl*)handle;
- return impl->error;
-}
-
-static void socket_daq_set_errbuf (void* handle, const char* s)
-{
- SockImpl* impl = (SockImpl*)handle;
- DPE(impl->error, "%s", s ? s : "");
-}
-
-static int socket_daq_get_device_index(void* handle, const char* device)
-{
- (void)handle;
- (void)device;
- return DAQ_ERROR_NOTSUP;
-}
-
-static int socket_daq_set_filter (void* handle, const char* filter)
-{
- (void)handle;
- (void)filter;
- return DAQ_ERROR_NOTSUP;
-}
-
-//-------------------------------------------------------------------------
-
-#ifdef BUILDING_SO
-DAQ_SO_PUBLIC DAQ_Module_t DAQ_MODULE_DATA =
-#else
-DAQ_Module_t socket_daq_module_data =
-#endif
-{
- .api_version = DAQ_API_VERSION,
- .module_version = DAQ_MOD_VERSION,
- .name = DAQ_NAME,
- .type = DAQ_TYPE,
- .initialize = socket_daq_initialize,
- .set_filter = socket_daq_set_filter,
- .start = socket_daq_start,
- .acquire = socket_daq_acquire,
- .inject = socket_daq_inject,
- .breakloop = socket_daq_breakloop,
- .stop = socket_daq_stop,
- .shutdown = socket_daq_shutdown,
- .check_status = socket_daq_check_status,
- .get_stats = socket_daq_get_stats,
- .reset_stats = socket_daq_reset_stats,
- .get_snaplen = socket_daq_get_snaplen,
- .get_capabilities = socket_daq_get_capabilities,
- .get_datalink_type = socket_daq_get_datalink_type,
- .get_errbuf = socket_daq_get_errbuf,
- .set_errbuf = socket_daq_set_errbuf,
- .get_device_index = socket_daq_get_device_index,
- .modify_flow = NULL,
- .hup_prep = NULL,
- .hup_apply = NULL,
- .hup_post = NULL,
-};
-
+++ /dev/null
-
-add_example_library(dpx inspectors dpx.cc)
-add_example_library(data_log inspectors data_log.cc)
+++ /dev/null
-
-insexlibdir = $(pkglibdir)/inspectors
-
-insexlib_LTLIBRARIES = libdpx.la
-libdpx_la_CXXFLAGS = $(AM_CXXFLAGS)
-libdpx_la_LDFLAGS = -export-dynamic -shared
-libdpx_la_SOURCES = dpx.cc
-
-insexlib_LTLIBRARIES += libdata_log.la
-libdata_log_la_CXXFLAGS = $(AM_CXXFLAGS)
-libdata_log_la_LDFLAGS = -export-dynamic -shared
-libdata_log_la_SOURCES = data_log.cc
-
-AM_CXXFLAGS = @AM_CXXFLAGS@
-
+++ /dev/null
-//--------------------------------------------------------------------------
-// Copyright (C) 2015-2016 Cisco and/or its affiliates. All rights reserved.
-//
-// This program is free software; you can redistribute it and/or modify it
-// under the terms of the GNU General Public License Version 2 as published
-// by the Free Software Foundation. You may not use, modify or distribute
-// this program under any other version of the GNU General Public License.
-//
-// This program is distributed in the hope that it will be useful, but
-// WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
-// General Public License for more details.
-//
-// You should have received a copy of the GNU General Public License along
-// with this program; if not, write to the Free Software Foundation, Inc.,
-// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-//--------------------------------------------------------------------------
-// data_log.cc author Russ Combs <rcombs@sourcefire.com>
-
-#ifdef HAVE_CONFIG_H
-#include "config.h"
-#endif
-
-#include <string.h>
-#include <time.h>
-
-#include <iostream>
-#include <string>
-
-#include "main/snort_debug.h"
-#include "main/snort_types.h"
-#include "framework/data_bus.h"
-#include "framework/inspector.h"
-#include "framework/module.h"
-#include "log/messages.h"
-#include "log/text_log.h"
-#include "protocols/packet.h"
-#include "profiler/profiler.h"
-#include "utils/stats.h"
-#include "flow/flow.h"
-#include "sfip/sfip_t.h"
-
-static const char* s_name = "data_log";
-static const char* f_name = "data.log";
-static const char* s_help = "log selected published data to data.log";
-
-static THREAD_LOCAL SimpleStats dl_stats;
-
-//-------------------------------------------------------------------------
-// log stuff
-//-------------------------------------------------------------------------
-
-static THREAD_LOCAL TextLog* tlog = nullptr;
-
-static void dl_tinit()
-{
- tlog = TextLog_Init(f_name, 64*K_BYTES, 1*M_BYTES);
-}
-
-static void dl_tterm()
-{
- TextLog_Term(tlog);
-}
-
-//-------------------------------------------------------------------------
-// data stuff
-//-------------------------------------------------------------------------
-
-class LogHandler : public DataHandler
-{
-public:
- LogHandler(std::string s)
- { key = s; }
-
- void handle(DataEvent& e, Flow*);
-
-private:
- std::string key;
-};
-
-void LogHandler::handle(DataEvent& e, Flow* f)
-{
- unsigned n;
- const char* b = (char*)e.get_data(n);
-
- // FIXIT-L hexify binary data
- std::string val(b, n);
-
- TextLog_Print(tlog, "%u, ", time(nullptr));
- TextLog_Print(tlog, "%s, %d, ", sfip_to_str(&f->client_ip), f->client_port);
- TextLog_Print(tlog, "%s, %d, ", sfip_to_str(&f->server_ip), f->server_port);
- TextLog_Print(tlog, "%s, %*s\n", key.c_str(), n, val.c_str());
-
- dl_stats.total_packets++;
-}
-
-//-------------------------------------------------------------------------
-// inspector stuff
-//-------------------------------------------------------------------------
-
-class DataLog : public Inspector
-{
-public:
- DataLog(std::string s) { key = s; }
-
- void show(SnortConfig*) override;
- void eval(Packet*) override { };
-
- bool configure(SnortConfig*) override
- {
- get_data_bus().subscribe(key.c_str(), new LogHandler(key));
- return true;
- }
-
-private:
- std::string key;
-};
-
-void DataLog::show(SnortConfig*)
-{
- LogMessage("%s config:\n", s_name);
- LogMessage(" key = %s\n", key.c_str());
-}
-
-//-------------------------------------------------------------------------
-// module stuff
-//-------------------------------------------------------------------------
-
-static const Parameter dl_params[] =
-{
- { "key", Parameter::PT_STRING, nullptr, "http_uri",
- "name of data buffer to log" },
-
- { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
-};
-
-class DataLogModule : public Module
-{
-public:
- DataLogModule() : Module(s_name, s_help, dl_params)
- { }
-
- const PegInfo* get_pegs() const override
- { return simple_pegs; }
-
- PegCount* get_counts() const override
- { return (PegCount*)&dl_stats; }
-
- bool set(const char*, Value& v, SnortConfig*) override;
-
-public:
- std::string key;
-};
-
-bool DataLogModule::set(const char*, Value& v, SnortConfig*)
-{
- if ( v.is("key") )
- key = v.get_string();
-
- else
- return false;
-
- return true;
-}
-
-//-------------------------------------------------------------------------
-// api stuff
-//-------------------------------------------------------------------------
-
-static Module* mod_ctor()
-{ return new DataLogModule; }
-
-static void mod_dtor(Module* m)
-{ delete m; }
-
-static Inspector* dl_ctor(Module* m)
-{
- DataLogModule* mod = (DataLogModule*)m;
- return new DataLog(mod->key);
-}
-
-static void dl_dtor(Inspector* p)
-{
- delete p;
-}
-
-static const InspectApi dl_api
-{
- {
- PT_INSPECTOR,
- sizeof(InspectApi),
- INSAPI_VERSION,
- 0,
- API_RESERVED,
- API_OPTIONS,
- s_name,
- s_help,
- mod_ctor,
- mod_dtor
- },
- IT_PASSIVE,
- (uint16_t)PktType::NONE,
- nullptr, // buffers
- nullptr, // service
- nullptr, // pinit
- nullptr, // pterm
- dl_tinit,
- dl_tterm,
- dl_ctor,
- dl_dtor,
- nullptr, // ssn
- nullptr // reset
-};
-
-SO_PUBLIC const BaseApi* snort_plugins[] =
-{
- &dl_api.base,
- nullptr
-};
-
+++ /dev/null
-//--------------------------------------------------------------------------
-// Copyright (C) 2014-2016 Cisco and/or its affiliates. All rights reserved.
-//
-// This program is free software; you can redistribute it and/or modify it
-// under the terms of the GNU General Public License Version 2 as published
-// by the Free Software Foundation. You may not use, modify or distribute
-// this program under any other version of the GNU General Public License.
-//
-// This program is distributed in the hope that it will be useful, but
-// WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
-// General Public License for more details.
-//
-// You should have received a copy of the GNU General Public License along
-// with this program; if not, write to the Free Software Foundation, Inc.,
-// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-//--------------------------------------------------------------------------
-// dpx.cc author Russ Combs <rcombs@sourcefire.com>
-
-#ifdef HAVE_CONFIG_H
-#include "config.h"
-#endif
-
-#include <assert.h>
-#include <sys/types.h>
-#include <stdlib.h>
-#include <ctype.h>
-#include <string.h>
-
-#include "main/snort_debug.h"
-#include "main/snort_types.h"
-#include "events/event_queue.h"
-#include "framework/inspector.h"
-#include "framework/module.h"
-#include "log/messages.h"
-#include "protocols/packet.h"
-#include "profiler/profiler.h"
-#include "utils/stats.h"
-
-#define DPX_GID 256
-#define DPX_SID 1
-
-static const char* s_name = "dpx";
-static const char* s_help = "dynamic inspector example";
-
-static THREAD_LOCAL ProfileStats dpxPerfStats;
-
-static THREAD_LOCAL SimpleStats dpxstats;
-
-//-------------------------------------------------------------------------
-// class stuff
-//-------------------------------------------------------------------------
-
-class Dpx : public Inspector
-{
-public:
- Dpx(uint16_t port, uint16_t max);
-
- void show(SnortConfig*) override;
- void eval(Packet*) override;
-
-private:
- uint16_t port;
- uint16_t max;
-};
-
-Dpx::Dpx(uint16_t p, uint16_t m)
-{
- port = p;
- max = m;
-}
-
-void Dpx::show(SnortConfig*)
-{
- LogMessage("%s config:\n", s_name);
- LogMessage(" port = %d\n", port);
- LogMessage(" max = %d\n", max);
-}
-
-void Dpx::eval(Packet* p)
-{
- // precondition - what we registered for
- assert(p->is_udp());
-
- if ( p->ptrs.dp == port && p->dsize > max )
- SnortEventqAdd(DPX_GID, DPX_SID);
-
- ++dpxstats.total_packets;
-}
-
-//-------------------------------------------------------------------------
-// module stuff
-//-------------------------------------------------------------------------
-
-static const Parameter dpx_params[] =
-{
- { "port", Parameter::PT_PORT, nullptr, nullptr,
- "port to check" },
-
- { "max", Parameter::PT_INT, "0:65535", "0",
- "maximum payload before alert" },
-
- { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
-};
-
-static const RuleMap dpx_rules[] =
-{
- { DPX_SID, "too much data sent to port" },
- { 0, nullptr }
-};
-
-class DpxModule : public Module
-{
-public:
- DpxModule() : Module(s_name, s_help, dpx_params)
- { }
-
- unsigned get_gid() const override
- { return DPX_GID; }
-
- const RuleMap* get_rules() const override
- { return dpx_rules; }
-
- const PegInfo* get_pegs() const override
- { return simple_pegs; }
-
- PegCount* get_counts() const override
- { return (PegCount*)&dpxstats; }
-
- ProfileStats* get_profile() const override
- { return &dpxPerfStats; }
-
- bool set(const char*, Value& v, SnortConfig*) override;
-
-public:
- uint16_t port;
- uint16_t max;
-};
-
-bool DpxModule::set(const char*, Value& v, SnortConfig*)
-{
- if ( v.is("port") )
- port = v.get_long();
-
- else if ( v.is("max") )
- max = v.get_long();
-
- else
- return false;
-
- return true;
-}
-
-//-------------------------------------------------------------------------
-// api stuff
-//-------------------------------------------------------------------------
-
-static Module* mod_ctor()
-{ return new DpxModule; }
-
-static void mod_dtor(Module* m)
-{ delete m; }
-
-static Inspector* dpx_ctor(Module* m)
-{
- DpxModule* mod = (DpxModule*)m;
- return new Dpx(mod->port, mod->max);
-}
-
-static void dpx_dtor(Inspector* p)
-{
- delete p;
-}
-
-static const InspectApi dpx_api
-{
- {
- PT_INSPECTOR,
- sizeof(InspectApi),
- INSAPI_VERSION,
- 0,
- API_RESERVED,
- API_OPTIONS,
- s_name,
- s_help,
- mod_ctor,
- mod_dtor
- },
- IT_NETWORK,
- (uint16_t)PktType::UDP,
- nullptr, // buffers
- nullptr, // service
- nullptr, // pinit
- nullptr, // pterm
- nullptr, // tinit
- nullptr, // tterm
- dpx_ctor,
- dpx_dtor,
- nullptr, // ssn
- nullptr // reset
-};
-
-SO_PUBLIC const BaseApi* snort_plugins[] =
-{
- &dpx_api.base,
- nullptr
-};
-
+++ /dev/null
-
-add_example_library(ips_urg ips_options ips_urg.cc)
-add_example_library(ips_pkt_num ips_options ips_pkt_num.cc)
-
-install (
- FILES find.lua
- DESTINATION "${EX_INSTALL_PATH}/ips_options"
-)
+++ /dev/null
-
-optlibdir = $(pkglibdir)/ips_options
-
-optlib_LTLIBRARIES = libips_pkt_num.la
-libips_pkt_num_la_CXXFLAGS = $(AM_CXXFLAGS)
-libips_pkt_num_la_LDFLAGS = -export-dynamic -shared
-libips_pkt_num_la_SOURCES = ips_pkt_num.cc
-
-optlib_LTLIBRARIES += libips_urg.la
-libips_urg_la_CXXFLAGS = $(AM_CXXFLAGS)
-libips_urg_la_LDFLAGS = -export-dynamic -shared
-libips_urg_la_SOURCES = ips_urg.cc
-
-dist_optlib_SCRIPTS = find.lua
-
-AM_CXXFLAGS = @AM_CXXFLAGS@
-
+++ /dev/null
--- ----------------------------------------------------------
--- ips_option example:
---
--- define keyword find
---
--- configure snort with
---
--- ./configure --prefix my/prefix
---
--- then set up the path as follows:
---
--- export LUA_PATH=my/prefix/include/snort/lua/?.lua\;\;
---
--- write a rule as follows:
---
--- alert tcp any any -> any 80 ( \
--- msg:"luajit example"; sid:1; \
--- content:"GET"; \
--- find:"pat='HTTP/1%.%d'"; )
---
--- the arg string is (in general) optional
--- if present, it will be put in a table named args, eg:
---
--- args { pat='GET .+ HTTP/1.1' }
---
--- this table is defined before init is called
--- the args string, if present, must be valid lua code like
--- name1 = value1, name2 = 'value2'.
--- ----------------------------------------------------------
-
--- this pulls in snort bindings with ffi
-require("snort_plugin")
-
--- init() is optional
--- if present, called once when script is loaded
--- here we return bool indicating args ok
-function init ()
- if ( args.pat == nil ) then
- return 'missing pat'
- end
-
- if ( type(args.pat) ~= 'string' ) then
- return 'pat must be string'
- end
-
- return true
-end
-
--- eval() is required
--- eval must return a bool (match == true)
-function eval ()
- -- buf is a luajit cdata
- local buf = ffi.C.get_buffer()
-
- -- str is a lua string
- local str = ffi.string(buf.data, buf.len)
-
- local i,j = string.find(str, args.pat)
-
- return (i and (i > 0))
-end
-
--- plugin table is required
-plugin =
-{
- type = "ips_option", -- only available type currently
- name = "find", -- rule option keyword
- version = 0 -- optional, defaults to zero
-}
-
+++ /dev/null
-//--------------------------------------------------------------------------
-// Copyright (C) 2014-2016 Cisco and/or its affiliates. All rights reserved.
-//
-// This program is free software; you can redistribute it and/or modify it
-// under the terms of the GNU General Public License Version 2 as published
-// by the Free Software Foundation. You may not use, modify or distribute
-// this program under any other version of the GNU General Public License.
-//
-// This program is distributed in the hope that it will be useful, but
-// WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
-// General Public License for more details.
-//
-// You should have received a copy of the GNU General Public License along
-// with this program; if not, write to the Free Software Foundation, Inc.,
-// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-//--------------------------------------------------------------------------
-
-// ips_pkt_num.cc author Russ Combs <rucombs@cisco.com>
-
-#ifdef HAVE_CONFIG_H
-#include "config.h"
-#endif
-
-#include <sys/types.h>
-#include <stdlib.h>
-#include <ctype.h>
-
-#include "main/snort_types.h"
-#include "main/thread.h"
-#include "detection/detection_defines.h"
-#include "detection/treenodes.h"
-#include "framework/ips_option.h"
-#include "framework/module.h"
-#include "framework/parameter.h"
-#include "framework/range.h"
-#include "hash/sfhashfcn.h"
-#include "protocols/packet.h"
-#include "protocols/tcp.h"
-#include "profiler/profiler.h"
-#include "utils/stats.h"
-
-static const char* s_name = "pkt_num";
-static const char* s_help = "alert on raw packet number";
-
-static THREAD_LOCAL ProfileStats pkt_num_perf_stats;
-
-//-------------------------------------------------------------------------
-// option
-//-------------------------------------------------------------------------
-
-class PktNumOption : public IpsOption
-{
-public:
- PktNumOption(const RangeCheck& c) : IpsOption(s_name)
- { config = c; }
-
- uint32_t hash() const override;
- bool operator==(const IpsOption&) const override;
-
- int eval(Cursor&, Packet*) override;
-
-private:
- RangeCheck config;
-};
-
-uint32_t PktNumOption::hash() const
-{
- uint32_t a, b, c;
-
- a = config.op;
- b = config.min;
- c = config.max;
-
- mix_str(a,b,c,get_name());
- finalize(a,b,c);
-
- return c;
-}
-
-bool PktNumOption::operator==(const IpsOption& ips) const
-{
- if ( strcmp(s_name, ips.get_name()) )
- return false;
-
- PktNumOption& rhs = (PktNumOption&)ips;
- return ( config == rhs.config );
-}
-
-int PktNumOption::eval(Cursor&, Packet*)
-{
- ProfileContext profile(pkt_num_perf_stats);
-
- if ( config.eval(get_packet_number()) )
- return DETECTION_OPTION_MATCH;
-
- return DETECTION_OPTION_NO_MATCH;
-}
-
-//-------------------------------------------------------------------------
-// module
-//-------------------------------------------------------------------------
-
-static const Parameter s_params[] =
-{
- { "~range", Parameter::PT_STRING, nullptr, nullptr,
- "check if packet number is in given range" },
-
- { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
-};
-
-class PktNumModule : public Module
-{
-public:
- PktNumModule() : Module(s_name, s_help, s_params) { }
-
- bool begin(const char*, int, SnortConfig*) override;
- bool set(const char*, Value&, SnortConfig*) override;
-
- ProfileStats* get_profile() const override
- { return &pkt_num_perf_stats; }
-
- RangeCheck data;
-};
-
-bool PktNumModule::begin(const char*, int, SnortConfig*)
-{
- data.init();
- return true;
-}
-
-bool PktNumModule::set(const char*, Value& v, SnortConfig*)
-{
- if ( !v.is("~range") )
- return false;
-
- return data.parse(v.get_string());
-}
-
-//-------------------------------------------------------------------------
-// api methods
-//-------------------------------------------------------------------------
-
-static Module* mod_ctor()
-{
- return new PktNumModule;
-}
-
-static void mod_dtor(Module* m)
-{
- delete m;
-}
-
-static IpsOption* pkt_num_ctor(Module* p, OptTreeNode*)
-{
- PktNumModule* m = (PktNumModule*)p;
- return new PktNumOption(m->data);
-}
-
-static void pkt_num_dtor(IpsOption* p)
-{
- delete p;
-}
-
-static const IpsApi pkt_num_api =
-{
- {
- PT_IPS_OPTION,
- sizeof(IpsApi),
- IPSAPI_VERSION,
- 0,
- API_RESERVED,
- API_OPTIONS,
- s_name,
- s_help,
- mod_ctor,
- mod_dtor
- },
- OPT_TYPE_DETECTION,
- 1, PROTO_BIT__TCP,
- nullptr, // pinit
- nullptr, // pterm
- nullptr, // tinit
- nullptr, // tterm
- pkt_num_ctor,
- pkt_num_dtor,
- nullptr
-};
-
-SO_PUBLIC const BaseApi* snort_plugins[] =
-{
- &pkt_num_api.base,
- nullptr
-};
-
+++ /dev/null
-//--------------------------------------------------------------------------
-// Copyright (C) 2014-2016 Cisco and/or its affiliates. All rights reserved.
-//
-// This program is free software; you can redistribute it and/or modify it
-// under the terms of the GNU General Public License Version 2 as published
-// by the Free Software Foundation. You may not use, modify or distribute
-// this program under any other version of the GNU General Public License.
-//
-// This program is distributed in the hope that it will be useful, but
-// WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
-// General Public License for more details.
-//
-// You should have received a copy of the GNU General Public License along
-// with this program; if not, write to the Free Software Foundation, Inc.,
-// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-//--------------------------------------------------------------------------
-
-// ips_urg.cc author Russ Combs <rucombs@cisco.com>
-
-#ifdef HAVE_CONFIG_H
-#include "config.h"
-#endif
-
-#include <sys/types.h>
-#include <stdlib.h>
-#include <ctype.h>
-
-#include "main/snort_types.h"
-#include "main/thread.h"
-#include "detection/detection_defines.h"
-#include "detection/treenodes.h"
-#include "framework/ips_option.h"
-#include "framework/module.h"
-#include "framework/parameter.h"
-#include "framework/range.h"
-#include "hash/sfhashfcn.h"
-#include "protocols/packet.h"
-#include "protocols/tcp.h"
-#include "profiler/profiler.h"
-
-static const char* s_name = "urg";
-static const char* s_help = "detection for TCP urgent pointer";
-
-static THREAD_LOCAL ProfileStats tcpUrgPerfStats;
-
-//-------------------------------------------------------------------------
-// option
-//-------------------------------------------------------------------------
-
-class TcpUrgOption : public IpsOption
-{
-public:
- TcpUrgOption(const RangeCheck& c) : IpsOption(s_name)
- { config = c; }
-
- uint32_t hash() const override;
- bool operator==(const IpsOption&) const override;
-
- int eval(Cursor&, Packet*) override;
-
-private:
- RangeCheck config;
-};
-
-uint32_t TcpUrgOption::hash() const
-{
- uint32_t a, b, c;
-
- a = config.op;
- b = config.min;
- c = config.max;
-
- mix_str(a,b,c,get_name());
- finalize(a,b,c);
-
- return c;
-}
-
-bool TcpUrgOption::operator==(const IpsOption& ips) const
-{
- if ( strcmp(s_name, ips.get_name()) )
- return false;
-
- TcpUrgOption& rhs = (TcpUrgOption&)ips;
- return ( config == rhs.config );
-}
-
-int TcpUrgOption::eval(Cursor&, Packet* p)
-{
- Profile profile(tcpUrgPerfStats);
-
- int rval = DETECTION_OPTION_NO_MATCH;
-
- if ( p->ptrs.tcph and p->ptrs.tcph->are_flags_set(TH_URG) and
- config.eval(p->ptrs.tcph->urp()) )
- {
- rval = DETECTION_OPTION_MATCH;
- }
-
- return rval;
-}
-
-//-------------------------------------------------------------------------
-// module
-//-------------------------------------------------------------------------
-
-static const Parameter s_params[] =
-{
- { "~range", Parameter::PT_STRING, nullptr, nullptr,
- "check if urgent offset is min<>max | <max | >min" },
-
- { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
-};
-
-class UrgModule : public Module
-{
-public:
- UrgModule() : Module(s_name, s_help, s_params) { }
-
- bool begin(const char*, int, SnortConfig*) override;
- bool set(const char*, Value&, SnortConfig*) override;
-
- ProfileStats* get_profile() const override
- { return &tcpUrgPerfStats; }
-
- RangeCheck data;
-};
-
-bool UrgModule::begin(const char*, int, SnortConfig*)
-{
- data.init();
- return true;
-}
-
-bool UrgModule::set(const char*, Value& v, SnortConfig*)
-{
- if ( !v.is("~range") )
- return false;
-
- return data.parse(v.get_string());
-}
-
-//-------------------------------------------------------------------------
-// api methods
-//-------------------------------------------------------------------------
-
-static Module* mod_ctor()
-{
- return new UrgModule;
-}
-
-static void mod_dtor(Module* m)
-{
- delete m;
-}
-
-static IpsOption* urg_ctor(Module* p, OptTreeNode*)
-{
- UrgModule* m = (UrgModule*)p;
- return new TcpUrgOption(m->data);
-}
-
-static void urg_dtor(IpsOption* p)
-{
- delete p;
-}
-
-static const IpsApi urg_api =
-{
- {
- PT_IPS_OPTION,
- sizeof(IpsApi),
- IPSAPI_VERSION,
- 0,
- API_RESERVED,
- API_OPTIONS,
- s_name,
- s_help,
- mod_ctor,
- mod_dtor
- },
- OPT_TYPE_DETECTION,
- 1, PROTO_BIT__TCP,
- nullptr, // pinit
- nullptr, // pterm
- nullptr, // tinit
- nullptr, // tterm
- urg_ctor,
- urg_dtor,
- nullptr
-};
-
-SO_PUBLIC const BaseApi* snort_plugins[] =
-{
- &urg_api.base,
- nullptr
-};
-
+++ /dev/null
-
-add_example_library(alert_ex loggers alert_ex.cc)
-add_example_library(alert_unixsock loggers alert_unixsock.cc)
-add_example_library(log_null loggers log_null.cc)
-
-install (
- FILES alert.lua
- DESTINATION "${EX_INSTALL_PATH}/loggers"
-)
+++ /dev/null
-
-loglibdir = $(pkglibdir)/loggers
-
-loglib_LTLIBRARIES = libalert_ex.la
-libalert_ex_la_CXXFLAGS = $(AM_CXXFLAGS)
-libalert_ex_la_LDFLAGS = -export-dynamic -shared
-libalert_ex_la_SOURCES = alert_ex.cc
-
-loglib_LTLIBRARIES += libalert_unixsock.la
-libalert_unixsock_la_CXXFLAGS = $(AM_CXXFLAGS)
-libalert_unixsock_la_LDFLAGS = -export-dynamic -shared
-libalert_unixsock_la_SOURCES = alert_unixsock.cc
-
-loglib_LTLIBRARIES += liblog_null.la
-liblog_null_la_CXXFLAGS = $(AM_CXXFLAGS)
-liblog_null_la_LDFLAGS = -export-dynamic -shared
-liblog_null_la_SOURCES = log_null.cc
-
-dist_loglib_SCRIPTS = alert.lua
-
-AM_CXXFLAGS = @AM_CXXFLAGS@
-
+++ /dev/null
--- ----------------------------------------------------------
--- logger example:
---
--- define keyword lualert
---
--- configure snort with
---
--- ./configure --prefix my/prefix
---
--- then set up the path as follows:
---
--- export LUA_PATH=my/prefix/include/snort/lua/?.lua\;\;
---
--- You can use with -A lualert by adding lualert to your
--- snort.lua:
---
--- lualert =
--- {
--- args = "num = 1, str = 'bar', cond = true"
--- }
---
--- the arg string is (in general) optional
--- if present, it will be put in a table named args, eg:
---
--- args = { num = 1, str = 'bar', cond = true }
---
--- this table is defined before init is called
--- the args string, if present, must be valid lua code like
--- above.
--- ----------------------------------------------------------
-
--- this pulls in snort bindings with ffi
-require("snort_plugin")
-
--- init() is optional
--- if present, called once when script is loaded
--- here we return bool indicating args ok
-function init ()
- return true
-end
-
--- alert() is required
-function alert ()
- -- get luajit structs
- local evt = ffi.C.get_event()
- local pkt = ffi.C.get_packet()
-
- -- str is a luajit string
- local str = ffi.string(evt.msg)
-
- -- FIXIT - this gets:
- -- bad argument #2 to 'format' (number expected, got cdata)
- --print(string.format('%ld %d:%d:%d %s',
- -- pkt.num, evt.gid, evt.sid, evt.rev, str))
-
- print(string.format('%d:%d:%d %s',
- evt.gid, evt.sid, evt.rev, str))
-end
-
--- plugin table is required
-plugin =
-{
- type = "logger",
- name = "lualert", -- eg -A lualert
- version = 0 -- optional version of this file
-}
-
+++ /dev/null
-//--------------------------------------------------------------------------
-// Copyright (C) 2014-2016 Cisco and/or its affiliates. All rights reserved.
-// Copyright (C) 2013-2013 Sourcefire, Inc.
-//
-// This program is free software; you can redistribute it and/or modify it
-// under the terms of the GNU General Public License Version 2 as published
-// by the Free Software Foundation. You may not use, modify or distribute
-// this program under any other version of the GNU General Public License.
-//
-// This program is distributed in the hope that it will be useful, but
-// WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
-// General Public License for more details.
-//
-// You should have received a copy of the GNU General Public License along
-// with this program; if not, write to the Free Software Foundation, Inc.,
-// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-//--------------------------------------------------------------------------
-
-// alert_ex.cc author Russ Combs <rucombs@cisco.com>
-
-#ifdef HAVE_CONFIG_H
-#include "config.h"
-#endif
-
-#include <ctype.h>
-#include <string.h>
-
-#include <algorithm>
-#include <iostream>
-using namespace std;
-
-#include "main/snort_types.h"
-#include "framework/logger.h"
-#include "framework/module.h"
-#include "protocols/packet.h"
-#include "detection/signature.h"
-
-static const char* s_name = "alert_ex";
-static const char* s_help = "output gid:sid:rev for alerts";
-
-//-------------------------------------------------------------------------
-// module stuff
-//-------------------------------------------------------------------------
-
-static const Parameter s_params[] =
-{
- { "upper", Parameter::PT_BOOL, nullptr, "false",
- "true/false -> convert to upper/lower case" },
-
- { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
-};
-
-class ExModule : public Module
-{
-public:
- ExModule() : Module(s_name, s_help, s_params) { }
-
- bool set(const char*, Value&, SnortConfig*) override;
- bool begin(const char*, int, SnortConfig*) override;
-
-public:
- bool upper;
-};
-
-bool ExModule::set(const char*, Value& v, SnortConfig*)
-{
- if ( v.is("packet") )
- upper = v.get_bool();
-
- else
- return false;
-
- return true;
-}
-
-bool ExModule::begin(const char*, int, SnortConfig*)
-{
- upper = true;
- return true;
-}
-
-//-------------------------------------------------------------------------
-// logger stuff
-//-------------------------------------------------------------------------
-
-class ExLogger : public Logger
-{
-public:
- ExLogger(ExModule* m)
- { upper = m->upper; }
-
- void alert(Packet*, const char* msg, Event*) override;
-
-private:
- bool upper;
-};
-
-void ExLogger::alert(Packet*, const char* msg, Event* e)
-{
- string s = msg;
-
- if ( upper )
- transform(s.begin(), s.end(), s.begin(), ::toupper);
- else
- transform(s.begin(), s.end(), s.begin(), ::tolower);
-
- cout << e->sig_info->generator << ":";
- cout << e->sig_info->id << ":";
- cout << e->sig_info->rev << " ";
- cout << s << endl;
-}
-
-//-------------------------------------------------------------------------
-// api stuff
-//-------------------------------------------------------------------------
-
-static Module* mod_ctor()
-{ return new ExModule; }
-
-static void mod_dtor(Module* m)
-{ delete m; }
-
-static Logger* ex_ctor(SnortConfig*, Module* mod)
-{
- return new ExLogger((ExModule*)mod);
-}
-
-static void ex_dtor(Logger* p)
-{ delete p; }
-
-static const LogApi ex_api =
-{
- {
- PT_LOGGER,
- sizeof(LogApi),
- LOGAPI_VERSION,
- 0,
- API_RESERVED,
- API_OPTIONS,
- s_name,
- s_help,
- mod_ctor,
- mod_dtor
- },
- OUTPUT_TYPE_FLAG__ALERT,
- ex_ctor,
- ex_dtor
-};
-
-SO_PUBLIC const BaseApi* snort_plugins[] =
-{
- &ex_api.base,
- nullptr
-};
-
+++ /dev/null
-//--------------------------------------------------------------------------
-// Copyright (C) 2014-2016 Cisco and/or its affiliates. All rights reserved.
-// Copyright (C) 2002-2013 Sourcefire, Inc.
-// Copyright (C) 1998-2002 Martin Roesch <roesch@sourcefire.com>
-// Copyright (C) 2000,2001 Andrew R. Baker <andrewb@uab.edu>
-//
-// This program is free software; you can redistribute it and/or modify it
-// under the terms of the GNU General Public License Version 2 as published
-// by the Free Software Foundation. You may not use, modify or distribute
-// this program under any other version of the GNU General Public License.
-//
-// This program is distributed in the hope that it will be useful, but
-// WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
-// General Public License for more details.
-//
-// You should have received a copy of the GNU General Public License along
-// with this program; if not, write to the Free Software Foundation, Inc.,
-// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-//--------------------------------------------------------------------------
-
-#ifdef HAVE_CONFIG_H
-#include "config.h"
-#endif
-
-#include <sys/types.h>
-#include <string.h>
-#include <sys/un.h>
-#include <unistd.h>
-#include <errno.h>
-
-#include <string>
-
-#include "main/snort_types.h"
-#include "main/snort_debug.h"
-#include "framework/logger.h"
-#include "framework/module.h"
-#include "detection/signature.h"
-#include "events/event.h"
-#include "protocols/packet.h"
-#include "utils/util.h"
-
-#define UNSOCK_FILE "snort_alert"
-
-/* this is equivalent to the 32-bit pcap pkthdr struct
- */
-struct pcap_pkthdr32
-{
- struct sf_timeval32 ts; /* packet timestamp */
- uint32_t caplen; /* packet capture length */
- uint32_t len; /* packet "real" length */
-};
-
-/* this struct is for the alert socket code.... */
-// FIXIT-L alert unix sock supports l2-l3-l4 encapsulations
-
-const unsigned int ALERTMSG_LENGTH = 256;
-struct Alertpkt
-{
- uint8_t alertmsg[ALERTMSG_LENGTH]; /* variable.. */
- struct pcap_pkthdr32 pkth;
- uint32_t dlthdr; /* datalink header offset. (ethernet, etc.. ) */
- uint32_t nethdr; /* network header offset. (ip etc...) */
- uint32_t transhdr; /* transport header offset (tcp/udp/icmp ..) */
- uint32_t data;
- uint32_t val; /* which fields are valid. (NULL could be
- * valids also) */
- /* Packet struct --> was null */
-#define NOPACKET_STRUCT 0x1
- /* no transport headers in packet */
-#define NO_TRANSHDR 0x2
- uint8_t pkt[65535]; // FIXIT-L move to end and send actual size
-
- uint32_t gid;
- uint32_t sid;
- uint32_t rev;
- uint32_t class_id;
- uint32_t priority;
-
- uint32_t event_id;
- uint32_t event_ref;
- struct sf_timeval32 ref_time;
-};
-
-struct UnixSock
-{
- int socket;
- struct sockaddr_un addr;
- Alertpkt alert;
-};
-
-static THREAD_LOCAL UnixSock us;
-
-#define s_name "alert_unixsock"
-
-//-------------------------------------------------------------------------
-// alert_unixsock module
-//-------------------------------------------------------------------------
-
-static const Parameter s_params[] =
-{
- // FIXIT-L add name param?
-
- { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
-};
-
-#define s_help \
- "output event over unix socket"
-
-class UnixSockModule : public Module
-{
-public:
- UnixSockModule() : Module(s_name, s_help, s_params) { }
-
- bool set(const char*, Value&, SnortConfig*) override
- { return false; }
-};
-
-//-------------------------------------------------------------------------
-
-static void get_alert_pkt(
- Packet* p, const char* msg, Event* event)
-{
- DebugMessage(DEBUG_LOG, "Logging Alert data!\n");
-
- // FIXIT-L ugh ...
- memset((char*)&us.alert,0,sizeof(us.alert));
-
- us.alert.gid = event->sig_info->generator;
- us.alert.sid = event->sig_info->id;
- us.alert.rev = event->sig_info->rev;
- us.alert.class_id = event->sig_info->class_id;
- us.alert.priority = event->sig_info->priority;
-
- us.alert.event_id = event->event_id;
- us.alert.event_ref = event->event_reference;
- us.alert.ref_time = event->ref_time;
-
- if (p && p->pkt)
- {
- memmove( (void*)&us.alert.pkth, (const void*)p->pkth, sizeof(us.alert.pkth));
- memmove(us.alert.pkt, (const void*)p->pkt, us.alert.pkth.caplen);
- }
- else
- us.alert.val |= NOPACKET_STRUCT;
-
- if (msg)
- {
- // FIXIT-L ugh ...
- memmove( (void*)us.alert.alertmsg, (const void*)msg,
- strlen(msg)>ALERTMSG_LENGTH-1 ? ALERTMSG_LENGTH - 1 : strlen(msg));
- }
-
- /* some data which will help monitoring utility to dissect packet */
- if (!(us.alert.val & NOPACKET_STRUCT))
- {
- if (p)
- {
- if (p->proto_bits & PROTO_BIT__ETH)
- {
- const eth::EtherHdr* eh = layer::get_eth_layer(p);
- us.alert.dlthdr=(char*)eh-(char*)p->pkt;
- }
-
- /* we don't log any headers besides eth yet */
- if (p->ptrs.ip_api.is_ip4() && p->pkt)
- {
- us.alert.nethdr=(char*)p->ptrs.ip_api.get_ip4h()-(char*)p->pkt;
-
- switch (p->type())
- {
- case PktType::TCP:
- if (p->ptrs.tcph)
- us.alert.transhdr=(char*)p->ptrs.tcph-(char*)p->pkt;
- break;
-
- case PktType::UDP:
- if (p->ptrs.udph)
- us.alert.transhdr=(char*)p->ptrs.udph-(char*)p->pkt;
- break;
-
- case PktType::ICMP:
- if (p->ptrs.icmph)
- us.alert.transhdr=(char*)p->ptrs.icmph-(char*)p->pkt;
- break;
-
- default:
- /* us.alert.transhdr is null due to initial memset */
- us.alert.val|=NO_TRANSHDR;
- break;
- } /* switch */
- }
-
- if (p->data && p->pkt)
- us.alert.data=p->data - p->pkt;
- }
- }
-}
-
-//-------------------------------------------------------------------------
-
-static void OpenAlertSock(void)
-{
- std::string name;
- get_instance_file(name, UNSOCK_FILE);
-
- if ( access(name.c_str(), W_OK) )
- ErrorMessage("%s file doesn't exist or isn't writable\n", name.c_str());
-
- memset((char*)&us.addr, 0, sizeof(us.addr));
- us.addr.sun_family = AF_UNIX;
-
- /* copy path over and preserve a null byte at the end */
- strncpy(us.addr.sun_path, name.c_str(), sizeof(us.addr.sun_path)-1);
-
- if ( (us.socket = socket(AF_UNIX, SOCK_DGRAM, 0)) < 0 )
- FatalError("socket() call failed: %s", get_error(errno));
-
-#ifdef FREEBSD
- int buflen=sizeof(us.alert);
-
- if ( setsockopt(us.socket, SOL_SOCKET, SO_SNDBUF, (char*)&buflen, sizeof(int)) < 0 )
- FatalError("setsockopt() call failed: %s", get_error(errno));
-#endif
-}
-
-//-------------------------------------------------------------------------
-
-class UnixSockLogger : public Logger
-{
-public:
- UnixSockLogger() { }
-
- void open() override;
- void close() override;
-
- void alert(Packet*, const char* msg, Event*) override;
-};
-
-void UnixSockLogger::open()
-{
- OpenAlertSock();
-}
-
-void UnixSockLogger::close()
-{
- if ( us.socket >= 0 )
- ::close(us.socket);
-
- us.socket = -1;
-}
-
-void UnixSockLogger::alert(Packet* p, const char* msg, Event* event)
-{
- get_alert_pkt(p, msg, event);
-
- if (sendto(us.socket,(const void*)&us.alert,sizeof(us.alert),
- 0,(struct sockaddr*)&us.addr,sizeof(us.addr))==-1)
- {
- /* whatever we do to sign that some alerts could be missed */
- }
-}
-
-//-------------------------------------------------------------------------
-
-static Module* mod_ctor()
-{ return new UnixSockModule; }
-
-static void mod_dtor(Module* m)
-{ delete m; }
-
-static Logger* unix_sock_ctor(SnortConfig*, Module*)
-{ return new UnixSockLogger; }
-
-static void unix_sock_dtor(Logger* p)
-{ delete p; }
-
-static LogApi unix_sock_api
-{
- {
- PT_LOGGER,
- sizeof(LogApi),
- LOGAPI_VERSION,
- 0,
- API_RESERVED,
- API_OPTIONS,
- s_name,
- s_help,
- mod_ctor,
- mod_dtor
- },
- OUTPUT_TYPE_FLAG__ALERT,
- unix_sock_ctor,
- unix_sock_dtor
-};
-
-SO_PUBLIC const BaseApi* snort_plugins[] =
-{
- &unix_sock_api.base,
- nullptr
-};
-
+++ /dev/null
-//--------------------------------------------------------------------------
-// Copyright (C) 2014-2016 Cisco and/or its affiliates. All rights reserved.
-// Copyright (C) 2002-2013 Sourcefire, Inc.
-// Copyright (C) 1998-2002 Martin Roesch <roesch@sourcefire.com>
-//
-// This program is free software; you can redistribute it and/or modify it
-// under the terms of the GNU General Public License Version 2 as published
-// by the Free Software Foundation. You may not use, modify or distribute
-// this program under any other version of the GNU General Public License.
-//
-// This program is distributed in the hope that it will be useful, but
-// WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
-// General Public License for more details.
-//
-// You should have received a copy of the GNU General Public License along
-// with this program; if not, write to the Free Software Foundation, Inc.,
-// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-//--------------------------------------------------------------------------
-
-/* This module is a NULL placeholder for people that want to turn off
- * logging for whatever reason. Please note that logging is separate from
- * alerting, they are completely separate output facilities within Snort.
- */
-
-#ifdef HAVE_CONFIG_H
-#include "config.h"
-#endif
-
-#include <sys/types.h>
-
-#include "framework/logger.h"
-#include "framework/module.h"
-
-#define s_name "log_null"
-#define s_help "disable logging of packets"
-
-//-------------------------------------------------------------------------
-// log_null module
-//-------------------------------------------------------------------------
-
-class NullLogger : public Logger
-{
-public:
- NullLogger() { }
-};
-
-static Logger* null_ctor(SnortConfig*, Module*)
-{ return new NullLogger; }
-
-static void null_dtor(Logger* p)
-{ delete p; }
-
-static LogApi null_api
-{
- {
- PT_LOGGER,
- sizeof(LogApi),
- LOGAPI_VERSION,
- 0,
- API_RESERVED,
- API_OPTIONS,
- s_name,
- s_help,
- nullptr, // mod_ctor,
- nullptr //mod_dtor
- },
- OUTPUT_TYPE_FLAG__LOG,
- null_ctor,
- null_dtor
-};
-
-SO_PUBLIC const BaseApi* snort_plugins[] =
-{
- &null_api.base,
- nullptr
-};
-
+++ /dev/null
-
-add_example_library(lowmem search_engines
- lowmem.cc
- sfksearch.cc
- sfksearch.h
- trie_api.cc
-)
+++ /dev/null
-
-selibdir = $(pkglibdir)/search_engines
-selib_LTLIBRARIES = liblowmem.la
-liblowmem_la_CXXFLAGS = $(AM_CXXFLAGS)
-liblowmem_la_LDFLAGS = -export-dynamic -shared
-
-liblowmem_la_SOURCES = \
-lowmem.cc \
-sfksearch.cc \
-sfksearch.h \
-trie_api.cc
-
-AM_CXXFLAGS = @AM_CXXFLAGS@
-
+++ /dev/null
-//--------------------------------------------------------------------------
-// Copyright (C) 2014-2016 Cisco and/or its affiliates. All rights reserved.
-// Copyright (C) 2002-2013 Sourcefire, Inc.
-//
-// This program is free software; you can redistribute it and/or modify it
-// under the terms of the GNU General Public License Version 2 as published
-// by the Free Software Foundation. You may not use, modify or distribute
-// this program under any other version of the GNU General Public License.
-//
-// This program is distributed in the hope that it will be useful, but
-// WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
-// General Public License for more details.
-//
-// You should have received a copy of the GNU General Public License along
-// with this program; if not, write to the Free Software Foundation, Inc.,
-// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-//--------------------------------------------------------------------------
-
-/*
-* An abstracted interface to the Multi-Pattern Matching routines,
-* thats why we're passing 'void *' objects around.
-*
-* Marc A Norton <mnorton@sourcefire.com>
-*
-* Updates:
-* 3/06 - Added AC_BNFA search
-*/
-// lowmem.cc author Russ Combs <rucombs@cisco.com>
-
-#ifdef HAVE_CONFIG_H
-#include "config.h"
-#endif
-
-#include "sfksearch.h"
-#include "main/snort_debug.h"
-#include "main/snort_types.h"
-#include "log/messages.h"
-#include "framework/mpse.h"
-#include "profiler/profiler.h"
-
-//-------------------------------------------------------------------------
-// "lowmem"
-//-------------------------------------------------------------------------
-
-class LowmemMpse : public Mpse
-{
-private:
- KTRIE_STRUCT* obj;
-
-public:
- LowmemMpse(SnortConfig*, bool use_gc, const MpseAgent* agent)
- : Mpse("lowmem", use_gc)
- { obj = KTrieNew(0, agent); }
-
- ~LowmemMpse()
- { KTrieDelete(obj); }
-
- int add_pattern(
- SnortConfig*, const uint8_t* P, unsigned m,
- const PatternDescriptor& desc, void* user) override
- {
- return KTrieAddPattern(obj, P, m, desc.no_case, desc.negated, user);
- }
-
- int prep_patterns(SnortConfig* sc) override
- {
- return KTrieCompile(sc, obj);
- }
-
- int _search(
- const uint8_t* T, int n, MpseMatch match,
- void* context, int* current_state) override
- {
- *current_state = 0;
- return KTrieSearch(obj, T, n, match, context);
- }
-
- int get_pattern_count() override
- { return KTriePatternCount(obj); }
-};
-
-//-------------------------------------------------------------------------
-// api
-//-------------------------------------------------------------------------
-
-static Mpse* lm_ctor(SnortConfig* sc, class Module*, bool use_gc, const MpseAgent* agent)
-{
- return new LowmemMpse(sc, use_gc, agent);
-}
-
-static void lm_dtor(Mpse* p)
-{
- delete p;
-}
-
-static void lm_init()
-{
- KTrie_init_xlatcase();
- KTrieInitMemUsed();
-}
-
-static void lm_print()
-{
- if ( !KTrieMemUsed() )
- return;
-
- double x = (double)KTrieMemUsed();
-
- LogMessage("[ LowMem Search-Method Memory Used : %g %s ]\n",
- (x > 1.e+6) ? x/1.e+6 : x/1.e+3,
- (x > 1.e+6) ? "MBytes" : "KBytes");
-}
-
-static const MpseApi lm_api =
-{
- {
- PT_SEARCH_ENGINE,
- sizeof(MpseApi),
- SEAPI_VERSION,
- 0,
- API_RESERVED,
- API_OPTIONS,
- "lowmem",
- "Keyword Trie (low memory, moderate performance) MPSE",
- nullptr,
- nullptr
- },
- false,
- nullptr,
- nullptr,
- nullptr,
- nullptr,
- lm_ctor,
- lm_dtor,
- lm_init,
- lm_print,
-};
-
-const BaseApi* se_lowmem = &lm_api.base;
-
+++ /dev/null
-//--------------------------------------------------------------------------
-// Copyright (C) 2001 Marc Norton
-// Copyright (C) 2014-2016 Cisco and/or its affiliates. All rights reserved.
-// Copyright (C) 2003-2013 Sourcefire, Inc.
-//
-// This program is free software; you can redistribute it and/or modify it
-// under the terms of the GNU General Public License Version 2 as published
-// by the Free Software Foundation. You may not use, modify or distribute
-// this program under any other version of the GNU General Public License.
-//
-// This program is distributed in the hope that it will be useful, but
-// WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
-// General Public License for more details.
-//
-// You should have received a copy of the GNU General Public License along
-// with this program; if not, write to the Free Software Foundation, Inc.,
-// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-//--------------------------------------------------------------------------
-/*
-* ksearch.c
-*
-* Basic Keyword Search Trie - uses linked lists to build the finite automata
-*
-* Keyword-Match: Performs the equivalent of a multi-string strcmp()
-* - use for token testing after parsing the language tokens using lex or the like.
-*
-* Keyword-Search: searches the input text for one of multiple keywords,
-* and supports case sensitivite and case insensitive patterns.
-*/
-#ifdef HAVE_CONFIG_H
-#include "config.h"
-#endif
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <sys/types.h>
-#include <ctype.h>
-
-#include "main/snort_types.h"
-#include "main/snort_debug.h"
-#include "main/thread.h"
-#include "sfksearch.h"
-#include "utils/snort_bounds.h"
-
-static void KTrieFree(KTRIENODE* n);
-
-static unsigned int mtot = 0;
-
-unsigned int KTrieMemUsed(void)
-{
- return mtot;
-}
-
-void KTrieInitMemUsed(void)
-{
- mtot = 0;
-}
-
-/*
-* Allocate Memory
-*/
-static void* KTRIE_MALLOC(int n)
-{
- void* p;
-
- if (n < 1)
- return NULL;
-
- p = calloc(1, n);
-
- if (p)
- mtot += n;
-
- return p;
-}
-
-/*
-* Free Memory
-*/
-static void KTRIE_FREE(void* p)
-{
- if (p == NULL)
- return;
-
- free(p);
-}
-
-/*
-* Local/Tmp nocase array
-*/
-static THREAD_LOCAL uint8_t Tnocase[65*1024];
-
-/*
-** Case Translation Table
-*/
-static uint8_t xlatcase[256];
-
-/*
-*
-*/
-void KTrie_init_xlatcase(void)
-{
- for (int i=0; i<256; i++)
- {
- xlatcase[ i ] = (uint8_t)tolower(i);
- }
-}
-
-/*
-*
-*/
-static inline void ConvertCaseEx(uint8_t* d, const uint8_t* s, int m)
-{
- int i;
- for ( i=0; i < m; i++ )
- {
- d[i] = xlatcase[ s[i] ];
- }
-}
-
-/*
-*
-*/
-KTRIE_STRUCT* KTrieNew(int method, const MpseAgent* agent)
-{
- KTRIE_STRUCT* ts = (KTRIE_STRUCT*)KTRIE_MALLOC(sizeof(KTRIE_STRUCT) );
-
- if ( !ts )
- return 0;
-
- memset(ts, 0, sizeof(KTRIE_STRUCT));
-
- ts->memory = sizeof(KTRIE_STRUCT);
- ts->nchars = 0;
- ts->npats = 0;
- ts->end_states = 0;
- ts->method = method; /* - old method, 1 = queue */
- ts->agent = agent;
-
- return ts;
-}
-
-int KTriePatternCount(KTRIE_STRUCT* k)
-{
- return k->npats;
-}
-
-/*
- * Deletes memory that was used in creating trie
- * and nodes
- */
-void KTrieDelete(KTRIE_STRUCT* k)
-{
- KTRIEPATTERN* p = NULL;
- KTRIEPATTERN* pnext = NULL;
- int i;
-
- if (k == NULL)
- return;
-
- p = k->patrn;
-
- while (p != NULL)
- {
- pnext = p->next;
-
- if (k->agent && p->user)
- k->agent->user_free(p->user);
-
- if (k->agent)
- {
- if (p && p->rule_option_tree)
- k->agent->tree_free(&p->rule_option_tree);
- }
-
- if (k->agent)
- {
- if (p && p->neg_list)
- k->agent->list_free(&p->neg_list);
- }
-
- KTRIE_FREE(p->P);
- KTRIE_FREE(p->Pcase);
- KTRIE_FREE(p);
-
- p = pnext;
- }
-
- for (i = 0; i < KTRIE_ROOT_NODES; i++)
- KTrieFree(k->root[i]);
-
- KTRIE_FREE(k);
-}
-
-/*
- * Recursively delete all nodes in trie
- */
-static void KTrieFree(KTRIENODE* n)
-{
- if (n == NULL)
- return;
-
- KTrieFree(n->child);
- KTrieFree(n->sibling);
-
- KTRIE_FREE(n);
-}
-
-/*
-*
-*/
-static KTRIEPATTERN* KTrieNewPattern(const uint8_t* P, unsigned n)
-{
- KTRIEPATTERN* p;
- int ret;
-
- if (n < 1)
- return NULL;
-
- p = (KTRIEPATTERN*)KTRIE_MALLOC(sizeof(KTRIEPATTERN) );
-
- if (p == NULL)
- return NULL;
-
- /* Save as a nocase string */
- p->P = (uint8_t*)KTRIE_MALLOC(n);
- if ( !p->P )
- {
- KTRIE_FREE(p);
- return NULL;
- }
-
- ConvertCaseEx(p->P, P, n);
-
- /* Save Case specific version */
- p->Pcase = (uint8_t*)KTRIE_MALLOC(n);
- if ( !p->Pcase )
- {
- KTRIE_FREE(p->P);
- KTRIE_FREE(p);
- return NULL;
- }
-
- ret = SafeMemcpy(p->Pcase, P, n, p->Pcase, p->Pcase + n);
- if (ret != SAFEMEM_SUCCESS)
- {
- KTRIE_FREE(p->Pcase);
- KTRIE_FREE(p->P);
- KTRIE_FREE(p);
- return NULL;
- }
-
- p->n = n;
- p->next = NULL;
-
- return p;
-}
-
-/*
-* Add Pattern info to the list of patterns
-*/
-int KTrieAddPattern(
- KTRIE_STRUCT* ts, const uint8_t* P, unsigned n,
- bool nocase, bool negative, void* user)
-{
- KTRIEPATTERN* pnew;
-
- if ( !ts->patrn )
- {
- pnew = ts->patrn = KTrieNewPattern(P, n);
-
- if ( !pnew )
- return -1;
- }
- else
- {
- pnew = KTrieNewPattern(P, n);
-
- if ( !pnew )
- return -1;
-
- pnew->next = ts->patrn; /* insert at head of list */
-
- ts->patrn = pnew;
- }
-
- pnew->nocase = nocase;
- pnew->negative = negative;
- pnew->user = user;
- pnew->mnext = NULL;
-
- ts->npats++;
- ts->memory += sizeof(KTRIEPATTERN) + 2 * n; /* Case and nocase */
-
- return 0;
-}
-
-/*
-*
-*/
-static KTRIENODE* KTrieCreateNode(KTRIE_STRUCT* ts)
-{
- KTRIENODE* t=(KTRIENODE*)KTRIE_MALLOC(sizeof(KTRIENODE) );
-
- if (!t)
- return 0;
-
- memset(t,0,sizeof(KTRIENODE));
-
- ts->memory += sizeof(KTRIENODE);
-
- return t;
-}
-
-/*
-* Insert a Pattern in the Trie
-*/
-static int KTrieInsert(KTRIE_STRUCT* ts, KTRIEPATTERN* px)
-{
- int type = 0;
- int n = px->n;
- uint8_t* P = px->P;
- KTRIENODE* root;
-
- /* Make sure we at least have a root character for the tree */
- if ( !ts->root[*P] )
- {
- ts->root[*P] = root = KTrieCreateNode(ts);
- if ( !root )
- return -1;
- root->edge = *P;
- }
- else
- {
- root = ts->root[*P];
- }
-
- /* Walk existing Patterns */
- while ( n )
- {
- if ( root->edge == *P )
- {
- P++;
- n--;
-
- if ( n && root->child )
- {
- root=root->child;
- }
- else /* cannot continue */
- {
- type = 0; /* Expand the tree via the child */
- break;
- }
- }
- else
- {
- if ( root->sibling )
- {
- root=root->sibling;
- }
- else /* cannot continue */
- {
- type = 1; /* Expand the tree via the sibling */
- break;
- }
- }
- }
-
- /*
- * Add the next char of the Keyword, if any
- */
- if ( n )
- {
- if ( type == 0 )
- {
- /*
- * Start with a new child to finish this Keyword
- */
- root->child= KTrieCreateNode(ts);
- if ( !root->child )
- return -1;
- root=root->child;
- root->edge = *P;
- P++;
- n--;
- ts->nchars++;
- }
- else
- {
- /*
- * Start a new sibling bracnch to finish this Keyword
- */
- root->sibling= KTrieCreateNode(ts);
- if ( !root->sibling )
- return -1;
- root=root->sibling;
- root->edge = *P;
- P++;
- n--;
- ts->nchars++;
- }
- }
-
- /*
- * Finish the keyword as child nodes
- */
- while ( n )
- {
- root->child = KTrieCreateNode(ts);
- if ( !root->child )
- return -1;
- root=root->child;
- root->edge = *P;
- P++;
- n--;
- ts->nchars++;
- }
-
- if ( root->pkeyword )
- {
- px->mnext = root->pkeyword; /* insert duplicates at front of list */
- root->pkeyword = px;
- ts->duplicates++;
- }
- else
- {
- root->pkeyword = px;
- ts->end_states++;
- }
-
- return 0;
-}
-
-/*
-*
-*/
-static void Build_Bad_Character_Shifts(KTRIE_STRUCT* kt)
-{
- int i,k;
- KTRIEPATTERN* plist;
-
- /* Calc the min pattern size */
- kt->bcSize = 32000;
-
- for ( plist=kt->patrn; plist!=NULL; plist=plist->next )
- {
- if ( plist->n < kt->bcSize )
- {
- kt->bcSize = plist->n; /* smallest pattern size */
- }
- }
-
- /*
- * Initialze the Bad Character shift table.
- */
- for (i = 0; i < KTRIE_ROOT_NODES; i++)
- {
- kt->bcShift[i] = (unsigned short)kt->bcSize;
- }
-
- /*
- * Finish the Bad character shift table
- */
- for ( plist=kt->patrn; plist!=NULL; plist=plist->next )
- {
- int shift, cindex;
-
- for ( k=0; k<kt->bcSize; k++ )
- {
- shift = kt->bcSize - 1 - k;
-
- cindex = plist->P[ k ];
-
- if ( shift < kt->bcShift[ cindex ] )
- {
- kt->bcShift[ cindex ] = (unsigned short)shift;
- }
- }
- }
-}
-
-static int KTrieBuildMatchStateNode(
- SnortConfig* sc, KTRIENODE* root, KTRIE_STRUCT* ts)
-{
- int cnt = 0;
- KTRIEPATTERN* p;
-
- if (!root)
- return 0;
-
- /* each and every prefix match at this root*/
- if (root->pkeyword)
- {
- for (p = root->pkeyword; p; p = p->mnext)
- {
- if (p->user)
- {
- if (p->negative)
- {
- ts->agent->negate_list(p->user, &root->pkeyword->neg_list);
- }
- else
- {
- ts->agent->build_tree(sc, p->user, &root->pkeyword->rule_option_tree);
- }
- }
-
- cnt++;
- }
-
- /* Last call to finalize the tree for this root */
- ts->agent->build_tree(sc, NULL, &root->pkeyword->rule_option_tree);
- }
-
- /* for child of this root */
- if (root->child)
- {
- cnt += KTrieBuildMatchStateNode(sc, root->child, ts);
- }
-
- /* 1st sibling of this root -- other siblings will be processed from
- * within the processing for root->sibling. */
- if (root->sibling)
- {
- cnt += KTrieBuildMatchStateNode(sc, root->sibling, ts);
- }
-
- return cnt;
-}
-
-static int KTrieBuildMatchStateTrees(SnortConfig* sc, KTRIE_STRUCT* ts)
-{
- int i, cnt = 0;
- KTRIENODE* root;
-
- /* Find the states that have a MatchList */
- for (i = 0; i < KTRIE_ROOT_NODES; i++)
- {
- root = ts->root[i];
- /* each and every prefix match at this root*/
- if ( root and ts->agent )
- {
- cnt += KTrieBuildMatchStateNode(sc, root, ts);
- }
- }
-
- return cnt;
-}
-
-/*
-* Build the Keyword TRIE
-*
-*/
-static inline int _KTrieCompile(KTRIE_STRUCT* ts)
-{
- KTRIEPATTERN* p;
- /*
- static int tmem=0; // unused
- */
-
- /*
- * Build the Keyword TRIE
- */
- for ( p=ts->patrn; p; p=p->next )
- {
- if ( KTrieInsert(ts, p) )
- return -1;
- }
-
- /*
- * Build A Setwise Bad Character Shift Table
- */
- Build_Bad_Character_Shifts(ts);
-
- /*
- tmem += ts->memory;
- printf(" Compile stats: %d patterns, %d chars, %d duplicate patterns, %d bytes, %d total-bytes\n",ts->npats,ts->nchars,ts->duplicates,ts->memory,tmem);
- */
-
- return 0;
-}
-
-int KTrieCompile(SnortConfig* sc, KTRIE_STRUCT* ts)
-{
- int rval;
-
- if ((rval = _KTrieCompile(ts)))
- return rval;
-
- if ( ts->agent )
- KTrieBuildMatchStateTrees(sc, ts);
-
- return 0;
-}
-
-void sfksearch_print_qinfo(void)
-{
-}
-
-/*
-* Search - Algorithm
-*
-* This routine will log any substring of T that matches a keyword,
-* and processes all prefix matches. This is used for generic
-* pattern searching with a set of keywords and a body of text.
-*
-*
-*
-* kt- Trie Structure
-* T - nocase text
-* Tc- case specific text
-* n - text length
-*
-* returns:
-* # pattern matches
-*/
-static inline int KTriePrefixMatch(
- KTRIE_STRUCT* kt, const uint8_t* T, const uint8_t*, const uint8_t* bT, int n,
- MpseMatch match, void* context)
-{
- KTRIENODE* root = kt->root[ *T ];
- int nfound = 0;
- KTRIEPATTERN* pk;
- int index;
-
- /* Check if any keywords start with this character */
- if ( !root )
- return 0;
-
- while ( n )
- {
- if ( root->edge == *T )
- {
- T++;
- n--;
-
- pk = root->pkeyword;
- if (pk)
- {
- index = (int)(T - bT);
- nfound++;
- if (match (pk->user, pk->rule_option_tree, index, context, pk->neg_list) > 0)
- {
- return nfound;
- }
- }
-
- if ( n && root->child )
- {
- root = root->child;
- }
- else /* cannot continue -- match is over */
- {
- break;
- }
- }
- else
- {
- if ( root->sibling )
- {
- root = root->sibling;
- }
- else /* cannot continue */
- {
- break;
- }
- }
- }
-
- return nfound;
-}
-
-/*
-*
-*/
-static inline int KTrieSearchNoBC(
- KTRIE_STRUCT* ks, const uint8_t* Tx, int n, MpseMatch match, void* context)
-{
- int nfound = 0;
- const uint8_t* T, * bT;
-
- ConvertCaseEx(Tnocase, Tx, n);
-
- T = Tnocase;
- bT = T;
-
- for (; n>0; n--, T++, Tx++ )
- {
- nfound += KTriePrefixMatch(ks, T, Tx, bT, n, match, context);
- }
-
- return nfound;
-}
-
-/*
-*
-*/
-static inline int KTrieSearchBC(
- KTRIE_STRUCT* ks, const uint8_t* Tx, int n, MpseMatch match, void* context)
-{
- int tshift;
- const uint8_t* Tend;
- const uint8_t* T, * bT;
- int nfound = 0;
- short* bcShift = (short*)ks->bcShift;
- int bcSize = ks->bcSize;
-
- ConvertCaseEx(Tnocase, Tx, n);
-
- T = Tnocase;
- bT = T;
-
- Tend = T + n - bcSize;
-
- bcSize--;
-
- for (; T <= Tend; n--, T++, Tx++ )
- {
- while ( (tshift = bcShift[ *( T + bcSize ) ]) > 0 )
- {
- T += tshift;
- Tx += tshift;
- if ( T > Tend )
- return nfound;
- }
-
- nfound += KTriePrefixMatch(ks, T, Tx, bT, n, match, context);
- }
-
- return nfound;
-}
-
-int KTrieSearch(
- KTRIE_STRUCT* ks, const uint8_t* T, int n, MpseMatch match, void* context)
-{
- if ( ks->bcSize < 3 )
- return KTrieSearchNoBC(ks, T, n, match, context);
- else
- return KTrieSearchBC(ks, T, n, match, context);
-}
-
-/*
-*
-* TEST DRIVER FOR KEYWORD TRIE
-*
-*/
-#ifdef KTRIE_MAIN
-
-char** gargv;
-
-int trie_nmatches = 0;
-
-int match(unsigned id, int index, void* context)
-{
- trie_nmatches++;
- data = context;
- printf("id=%d found at index=%d, %s\n",id,index,gargv[id]);
- return 0;
-}
-
-/*
-*
-*/
-int main(int argc, char** argv)
-{
- int i;
- KTRIE_STRUCT* ts;
- int nocase=1; // don't care about case
-
- gargv = argv;
-
- ts = KTrieNew();
-
- if ( argc < 3 )
- {
- printf("%s text pat1 pat2 ... patn [-c(ase-sensitive)\n",argv[0]);
- printf("search for keywords-default, or match keywords\n");
- exit(0);
- }
-
- for (i=1; i<argc; i++)
- {
- if ( strcmp(argv[i],"-c")==0 )
- nocase=0; /* ignore case */
- }
-
- printf("New TRIE created\n");
-
- for (i=2; i<argc; i++)
- {
- if ( argv[i][0]=='-' )
- continue;
-
- KTrieAddPattern(ts, (uint8_t*)argv[i], strlen(argv[i]), nocase, i);
- }
-
- printf("Patterns added \n");
-
- KTrieCompile(nullptr, ts);
-
- printf("Patterns compiled \n");
- printf("--> %d characters, %d patterns, %d bytes allocated\n",ts->nchars,ts->npats,ts->memory);
-
- printf("Searching...\n");
-
- KTrieSearch(ts, (uint8_t*)argv[1], strlen(argv[1]), match, 0);
-
- printf("%d matches found\n",trie_nmatches);
-
- printf("normal pgm finish.\n");
-
- return 0;
-}
-
-#endif
-
+++ /dev/null
-//--------------------------------------------------------------------------
-// Copyright (C) 2014-2016 Cisco and/or its affiliates. All rights reserved.
-// Copyright (C) 2003-2013 Sourcefire, Inc.
-// Copyright (C) 2001 Marc Norton
-//
-// This program is free software; you can redistribute it and/or modify it
-// under the terms of the GNU General Public License Version 2 as published
-// by the Free Software Foundation. You may not use, modify or distribute
-// this program under any other version of the GNU General Public License.
-//
-// This program is distributed in the hope that it will be useful, but
-// WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
-// General Public License for more details.
-//
-// You should have received a copy of the GNU General Public License along
-// with this program; if not, write to the Free Software Foundation, Inc.,
-// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-//--------------------------------------------------------------------------
-
-#ifndef SFKSEARCH_H
-#define SFKSEARCH_H
-
-// ksearch.h - Trie based multi-pattern matcher
-
-#include <stdint.h>
-#include "search_engines/search_common.h"
-
-struct KTRIEPATTERN
-{
- KTRIEPATTERN* next; /* global list of all patterns*/
- KTRIEPATTERN* mnext; /* matching list of duplicate keywords*/
-
- uint8_t* P; /* no case*/
- uint8_t* Pcase; /* case sensitive*/
-
- void* user;
- void* rule_option_tree;
- void* neg_list;
-
- int n;
- int nocase;
- int negative;
-};
-
-struct KTRIENODE
-{
- int edge; /* character*/
-
- KTRIENODE* sibling;
- KTRIENODE* child;
-
- KTRIEPATTERN* pkeyword;
-};
-
-#define KTRIE_ROOT_NODES 256
-
-struct KTRIE_STRUCT
-{
- KTRIEPATTERN* patrn; /* List of patterns, built as they are added*/
- KTRIENODE* root[KTRIE_ROOT_NODES]; /* KTrie nodes*/
-
- const struct MpseAgent* agent;
-
- int memory;
- int nchars;
- int npats;
- int duplicates;
- int method;
- int end_states; /* should equal npats - duplicates*/
-
- int bcSize;
- unsigned short bcShift[KTRIE_ROOT_NODES];
-};
-
-void KTrie_init_xlatcase();
-
-KTRIE_STRUCT* KTrieNew(int method, const MpseAgent*);
-
-int KTrieAddPattern(
- KTRIE_STRUCT*, const uint8_t* P, unsigned n,
- bool nocase, bool negative, void* id);
-
-int KTrieCompile(struct SnortConfig*, KTRIE_STRUCT*);
-
-int KTrieSearch(KTRIE_STRUCT*, const uint8_t* T, int n, MpseMatch, void* context);
-
-unsigned int KTrieMemUsed();
-void KTrieInitMemUsed();
-
-void KTrieDelete(KTRIE_STRUCT*);
-int KTriePatternCount(KTRIE_STRUCT*);
-
-void sfksearch_print_qinfo();
-
-#endif
-
+++ /dev/null
-//--------------------------------------------------------------------------
-// Copyright (C) 2014-2016 Cisco and/or its affiliates. All rights reserved.
-// Copyright (C) 2013-2013 Sourcefire, Inc.
-//
-// This program is free software; you can redistribute it and/or modify it
-// under the terms of the GNU General Public License Version 2 as published
-// by the Free Software Foundation. You may not use, modify or distribute
-// this program under any other version of the GNU General Public License.
-//
-// This program is distributed in the hope that it will be useful, but
-// WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
-// General Public License for more details.
-//
-// You should have received a copy of the GNU General Public License along
-// with this program; if not, write to the Free Software Foundation, Inc.,
-// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-//--------------------------------------------------------------------------
-// trie_api.cc author Russ Combs <rucombs@cisco.com>
-
-#include "framework/mpse.h"
-
-extern const BaseApi* se_lowmem;
-
-SO_PUBLIC const BaseApi* snort_plugins[] =
-{
- se_lowmem,
- nullptr
-};
-
+++ /dev/null
-
-# Use this macro to create text files
-macro (create_txt_header txt_file hdr_file)
-
- add_custom_command( OUTPUT ${hdr_file}
- COMMAND
- "${SNORT_EXECUTABLE}" --rule-to-text < "${CMAKE_CURRENT_LIST_DIR}/${txt_file}" > "${CMAKE_CURRENT_BINARY_DIR}/${hdr_file}"
- DEPENDS "${txt_file}"
- WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}
- COMMENT "so_rules: Building ${hdr_file}"
- )
- include_directories(${CMAKE_CURRENT_BINARY_DIR})
-
-endmacro (create_txt_header)
-
-# Use this macro to create hex files
-macro (create_pro_header txt_file hdr_file)
-
- add_custom_command( OUTPUT ${hdr_file}
- COMMAND
- "${SNORT_EXECUTABLE}" --rule-to-hex < "${CMAKE_CURRENT_LIST_DIR}/${txt_file}" > "${CMAKE_CURRENT_BINARY_DIR}/${hdr_file}"
- DEPENDS "${txt_file}"
- WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}
- COMMENT "so_rules: Building ${hdr_file}"
- )
- include_directories(${CMAKE_CURRENT_BINARY_DIR})
-endmacro (create_pro_header)
-
-
-create_txt_header(sid_18758.txt sid_18758.h)
-add_example_library(18758 so_rules sid_18758.cc sid_18758.h)
-
-
-# if we had a .pro file name 187589.pro and a source file names sid_18759.cc
-#create_txt_header(187589.pro 187589.h)
-#add_example_library(187589 so_rules 187589.cc 187589.h)
+++ /dev/null
-
-optlibdir = $(pkglibdir)/so_rules
-optlib_LTLIBRARIES = lib18758.la
-lib18758_la_CXXFLAGS = $(AM_CXXFLAGS)
-lib18758_la_LDFLAGS = -export-dynamic -shared
-lib18758_la_SOURCES = sid_18758.cc sid_18758.h
-
-# to make plain text rule header:
-%.h : %.txt
- snort --rule-to-text < $< > $@
-
-# to make compressed rule header:
-%.h : %.pro
- snort --rule-to-hex < $< > $@
-
-AM_CXXFLAGS = @AM_CXXFLAGS@
-
+++ /dev/null
-//--------------------------------------------------------------------------
-// Copyright (C) 2014-2016 Cisco and/or its affiliates. All rights reserved.
-//
-// This program is free software; you can redistribute it and/or modify it
-// under the terms of the GNU General Public License Version 2 as published
-// by the Free Software Foundation. You may not use, modify or distribute
-// this program under any other version of the GNU General Public License.
-//
-// This program is distributed in the hope that it will be useful, but
-// WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
-// General Public License for more details.
-//
-// You should have received a copy of the GNU General Public License along
-// with this program; if not, write to the Free Software Foundation, Inc.,
-// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-//--------------------------------------------------------------------------
-// sid_18758.cc author Russ Combs <rucombs@cisco.com>
-
-#ifdef HAVE_CONFIG_H
-#include "config.h"
-#endif
-
-#include <assert.h>
-#include <string.h>
-
-#include "main/snort_types.h"
-#include "framework/so_rule.h"
-#include "detection/detection_defines.h"
-#include "sid_18758.h"
-
-static int eval(void*, Cursor&, Packet*)
-{
- return DETECTION_OPTION_MATCH;
-}
-
-static SoEvalFunc ctor(const char* /*so*/, void** pv)
-{
- // so == "eval" here because that's our only so: option
- // but we could use multiple so: options and bind to
- // different functions based on the value of so
- // *pv can point to any data we need to use with so
- *pv = nullptr;
- return eval;
-}
-
-static void dtor(void* /*pv*/)
-{
- // cast pv to your type here
- // and then delete it
-}
-
-static const SoApi so_api =
-{
- {
- PT_SO_RULE,
- sizeof(SoApi),
- SOAPI_VERSION,
- 8,
- API_RESERVED,
- API_OPTIONS,
- "3|18758",
- "SO rule example",
- nullptr,
- nullptr
- },
- (uint8_t*)rule_18758,
- rule_18758_len,
- nullptr, // pinit
- nullptr, // pterm
- nullptr, // tinit
- nullptr, // tterm
- ctor,
- dtor,
-};
-
-// other snort plugins can be put in this list as needed
-// eg multiple rules in one so, custom rule options, etc.
-SO_PUBLIC const BaseApi* snort_plugins[] =
-{
- &so_api.base,
- nullptr
-};
-
+++ /dev/null
-const uint8_t rule_18758[] =
-{
- 0x61, 0x6C, 0x65, 0x72, 0x74, 0x20, 0x74, 0x63, 0x70, 0x20, 0x24, 0x48, 0x4F, 0x4D, 0x45, 0x5F,
- 0x4E, 0x45, 0x54, 0x20, 0x61, 0x6E, 0x79, 0x20, 0x2D, 0x3E, 0x20, 0x24, 0x45, 0x58, 0x54, 0x45,
- 0x52, 0x4E, 0x41, 0x4C, 0x5F, 0x4E, 0x45, 0x54, 0x20, 0x24, 0x48, 0x54, 0x54, 0x50, 0x5F, 0x50,
- 0x4F, 0x52, 0x54, 0x53, 0x0A, 0x28, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x6D, 0x73, 0x67, 0x3A, 0x22,
- 0x46, 0x49, 0x4C, 0x45, 0x2D, 0x49, 0x44, 0x45, 0x4E, 0x54, 0x49, 0x46, 0x59, 0x20, 0x4D, 0x69,
- 0x63, 0x72, 0x6F, 0x73, 0x6F, 0x66, 0x74, 0x20, 0x57, 0x69, 0x6E, 0x64, 0x6F, 0x77, 0x73, 0x20,
- 0x56, 0x69, 0x73, 0x75, 0x61, 0x6C, 0x20, 0x42, 0x61, 0x73, 0x69, 0x63, 0x20, 0x73, 0x63, 0x72,
- 0x69, 0x70, 0x74, 0x20, 0x66, 0x69, 0x6C, 0x65, 0x20, 0x64, 0x6F, 0x77, 0x6E, 0x6C, 0x6F, 0x61,
- 0x64, 0x20, 0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x22, 0x3B, 0x0A, 0x20, 0x20, 0x20, 0x20,
- 0x6D, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x3A, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65,
- 0x20, 0x68, 0x74, 0x74, 0x70, 0x3B, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x72, 0x65, 0x66, 0x65, 0x72,
- 0x65, 0x6E, 0x63, 0x65, 0x3A, 0x75, 0x72, 0x6C, 0x2C, 0x65, 0x6E, 0x2E, 0x77, 0x69, 0x6B, 0x69,
- 0x70, 0x65, 0x64, 0x69, 0x61, 0x2E, 0x6F, 0x72, 0x67, 0x2F, 0x77, 0x69, 0x6B, 0x69, 0x2F, 0x56,
- 0x62, 0x73, 0x3B, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x63, 0x6C, 0x61, 0x73, 0x73, 0x74, 0x79, 0x70,
- 0x65, 0x3A, 0x6D, 0x69, 0x73, 0x63, 0x2D, 0x61, 0x63, 0x74, 0x69, 0x76, 0x69, 0x74, 0x79, 0x3B,
- 0x0A, 0x20, 0x20, 0x20, 0x20, 0x73, 0x69, 0x64, 0x3A, 0x31, 0x38, 0x37, 0x35, 0x38, 0x3B, 0x0A,
- 0x20, 0x20, 0x20, 0x20, 0x72, 0x65, 0x76, 0x3A, 0x38, 0x3B, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x73,
- 0x6F, 0x69, 0x64, 0x3A, 0x33, 0x7C, 0x31, 0x38, 0x37, 0x35, 0x38, 0x3B, 0x0A, 0x23, 0x20, 0x65,
- 0x76, 0x65, 0x72, 0x79, 0x74, 0x68, 0x69, 0x6E, 0x67, 0x20, 0x61, 0x62, 0x6F, 0x76, 0x65, 0x20,
- 0x61, 0x70, 0x70, 0x65, 0x61, 0x72, 0x73, 0x20, 0x69, 0x6E, 0x20, 0x73, 0x74, 0x75, 0x62, 0x0A,
- 0x23, 0x20, 0x74, 0x68, 0x65, 0x20, 0x66, 0x6F, 0x6C, 0x6C, 0x6F, 0x77, 0x69, 0x6E, 0x67, 0x20,
- 0x64, 0x65, 0x74, 0x65, 0x63, 0x74, 0x69, 0x6F, 0x6E, 0x20, 0x6F, 0x70, 0x74, 0x69, 0x6F, 0x6E,
- 0x73, 0x20, 0x61, 0x72, 0x65, 0x20, 0x6E, 0x6F, 0x74, 0x20, 0x69, 0x6E, 0x20, 0x70, 0x72, 0x6F,
- 0x74, 0x65, 0x63, 0x74, 0x65, 0x64, 0x20, 0x73, 0x74, 0x75, 0x62, 0x0A, 0x20, 0x20, 0x20, 0x20,
- 0x66, 0x6C, 0x6F, 0x77, 0x3A, 0x74, 0x6F, 0x5F, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x2C, 0x65,
- 0x73, 0x74, 0x61, 0x62, 0x6C, 0x69, 0x73, 0x68, 0x65, 0x64, 0x3B, 0x0A, 0x20, 0x20, 0x20, 0x20,
- 0x68, 0x74, 0x74, 0x70, 0x5F, 0x75, 0x72, 0x69, 0x3B, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x63, 0x6F,
- 0x6E, 0x74, 0x65, 0x6E, 0x74, 0x3A, 0x22, 0x2E, 0x76, 0x62, 0x73, 0x22, 0x2C, 0x20, 0x6E, 0x6F,
- 0x63, 0x61, 0x73, 0x65, 0x3B, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x70, 0x63, 0x72, 0x65, 0x3A, 0x22,
- 0x2F, 0x5C, 0x78, 0x32, 0x65, 0x76, 0x62, 0x73, 0x28, 0x5B, 0x5C, 0x3F, 0x5C, 0x78, 0x35, 0x63,
- 0x5C, 0x78, 0x32, 0x66, 0x5D, 0x7C, 0x24, 0x29, 0x2F, 0x73, 0x6D, 0x69, 0x22, 0x3B, 0x0A, 0x20,
- 0x20, 0x20, 0x20, 0x73, 0x6F, 0x3A, 0x65, 0x76, 0x61, 0x6C, 0x3B, 0x0A, 0x29, 0x0A, 0x00,
-};
-const unsigned rule_18758_len = 0;
+++ /dev/null
-alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS
-(
- msg:"FILE-IDENTIFY Microsoft Windows Visual Basic script file download request";
- metadata:service http;
- reference:url,en.wikipedia.org/wiki/Vbs;
- classtype:misc-activity;
- sid:18758;
- rev:8;
- soid:3|18758;
-# everything above appears in stub
-# the following detection options are not in protected stub
- flow:to_server,established;
- http_uri;
- content:".vbs", nocase;
- pcre:"/\x2evbs([\?\x5c\x2f]|$)/smi";
- so:eval;
-)
projects / thirdparty / snort3.git / commitdiff
